Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

On the night of October 11–12, 2026, Iranian state-backed hackers from the IRGC-affiliated Shahid Kaveh unit compromised industrial refrigeration controllers across more than 700 French retail locations—including Casino, Leclerc, Carrefour, Intermarché, and Metro—remotely manipulating defrost temperature settings to cause equipment failures. The attacks destroyed tens of millions of euros in food inventory, sparked at least 15 fires, and extended to Schneider Electric ICS equipment at small hydroelectric installations. France's C4 coordination center attributed the campaign to Shahid Kaveh based on shared attacker infrastructure, FOFA reconnaissance tooling, Farsi-language artifacts, and propagation via the CyberbanNews outlet on October 13, 2026.

This incident signals an accelerating shift in Iranian cyber operations from espionage toward destructive ICS/OT sabotage targeting civilian critical infrastructure in Europe. Shahid Kaveh's prior campaigns against Israeli and U.S. refrigeration and industrial control systems in early 2026 confirm a repeatable, scalable playbook now being deployed against NATO-aligned nations, raising urgent questions about OT network segmentation and real-time anomaly detection in food and energy supply chains.

Why This Matters Now

Nation-state actors are actively weaponizing internet-exposed industrial control systems to cause physical damage and economic disruption in civilian supply chains. With FBI and CISA issuing active warnings about refrigeration and cold-chain targeting, and a second wave already hitting six European countries, organizations operating OT environments face immediate risk if ICS devices remain accessible without east-west segmentation, encrypted communications, and anomaly-based detection.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers used the FOFA internet-connected device search platform to identify and remotely access internet-exposed industrial refrigeration controllers, then manipulated defrost settings to cause equipment failures and fires. The lack of OT network segmentation and encrypted device communications allowed unauthorized remote access without detection.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attackers exploited flat, internet-exposed OT network topology to reach hundreds of industrial refrigeration controllers without any meaningful segmentation barrier. By enforcing identity-aware segmentation and controlled ingress boundaries, CNSF would likely have reduced the attacker's reachability across distributed retail and food-chain sites, constraining the blast radius of this coordinated sabotage campaign.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Internet-facing OT management interfaces would likely have had their direct reachability constrained, reducing the attacker's ability to discover and access controllers at scale from arbitrary external origins.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation policies would likely reduce the scope of what an authenticated session can reach beyond the initially contacted device, constraining how broadly administrative access could be exercised across the OT environment.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west enforcement policies would likely constrain the attacker's ability to move freely between OT zones across sites, reducing the breadth of devices reachable from any single compromised entry point.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility and control across distributed OT-connected environments would likely surface anomalous outbound protocol activity and persistent management-channel sessions, reducing the attacker's ability to maintain undetected C2 presence at scale.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress enforcement policies would likely constrain any incidental outbound data flows from OT device segments to unauthorized external destinations, reducing the available channels for even opportunistic data collection during reconnaissance.

Impact (Mitigations)

The combined effect of reduced ingress reachability, broken cross-site OT topology, and constrained management channel access would likely limit the attacker's operational reach to a fraction of the 700-plus targeted locations, meaningfully reducing physical damage scope.

Impact at a Glance

Affected Business Functions

  • Cold Chain and Refrigeration Infrastructure Operations
  • Food Safety and Perishable Inventory Management
  • Retail Store Operations and Point-of-Sale Continuity
  • Industrial Control System (ICS/OT) Availability
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: $50,000,000

Data Exposure

No confirmed exfiltration of customer PII or financial records was reported. The primary impact was physical and operational: destruction of perishable food inventory across approximately 700 retail locations including supermarkets, butcher shops, a slaughterhouse, and cooperative food-processing facilities operated by Casino, Leclerc, Cooperative U, Metro, Carrefour, and Intermarch. At least 15 fires were caused by overheated refrigeration equipment. French national blood service facilities storing blood products were also compromised, posing a critical public health risk. Tens of millions of euros in food losses and significant material damage to refrigeration hardware were confirmed by French authorities. Secondary attacks targeted Schneider Electric industrial control systems at small hydroelectric installations, indicating broader critical infrastructure targeting.

Recommended Actions

  • • Apply Zero Trust Segmentation (CNSF) to OT and ICS environments by enforcing identity-based microsegmentation policies that prevent any internet-facing exposure of industrial refrigeration controllers and restrict device-to-device communication to explicitly authorized flows only, eliminating the flat network topology that enabled multi-site lateral movement.
  • • Deploy Cloud Firewall (ACF) and Egress Security controls to block outbound OT device communication to unauthorized external destinations and restrict inbound management access to controllers through FQDN-based allowlisting and policy enforcement, closing the attack surface exploited via FOFA-identified internet-exposed devices.
  • • Implement East-West Traffic Security monitoring across hybrid OT-IT network boundaries to detect and alert on anomalous workload-to-workload and device-to-device communication patterns that deviate from learned baselines, enabling early detection of lateral movement across geographically distributed retail sites before impact is achieved.
  • • Leverage Multicloud Visibility and Control capabilities to establish centralized traffic observability across all OT control plane interactions, ensuring that simultaneous configuration changes issued to hundreds of devices overnight generate anomaly alerts correlated across sites rather than appearing as isolated local events.
  • • Enable Inline IPS (Suricata) inspection on OT network ingress and egress paths to detect known exploit patterns and malicious payload signatures associated with ICS-targeted attacks, supplemented by Threat Detection and Anomaly Response baselining to identify deviations from normal refrigeration controller behavior such as unauthorized defrost parameter modifications.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image