What is Shahid Kaveh, ⁠⁠the Iran cyberunit tied to France’s fridge hacking?

The alleged sabotage campaign targeted 700 commercial sites across France between October 11 and 12, according to a statement from the Paris prosecutor’s office.

The attack, which France’s Foreign Minister Jean-Noel Barrot described as "unprecedented in its level of aggression," saw Shahid Kaveh remotely crank up temperatures in refrigeration systems.

This action spoiled millions of euros’ worth of food, causing significant disruption to supermarket operations.

The French government has named Shahid Kaveh as the offensive cyberunit responsible for the incident.

The unit is described as being affiliated with the IRGC’s cyberelectronic command (CEC).

Three alleged perpetrators have been identified: Hamid Reza Lashgarian, the head of the CEC, and Mahdi Lashgarian and Reza Salarvand, commanders in the Shahid Kaveh unit.

Iran denies involvement

Iran has pushed back against the accusations, calling them "baseless and biased" in a statement from its Foreign Ministry.

The ministry described the accusations as a "highly irresponsible and contemptible action to tarnish Iran’s image and disrupt its relations with other countries".

The statement warned that Tehran would not hesitate to take measures to safeguard its national interests and security.

However, the statement made no mention of the Shahid Kaveh unit.

Who is Shahid Kaveh?

Iran’s government has never publicly acknowledged the existence or purpose of Shahid Kaveh.

The unit is named after Mahmoud Kaveh, an IRGC commander who died aged 25 in 1986 during the Iran-Iraq war.

Western intelligence agencies have linked it to the IRGC, assessing that it is part of a network of hackers operating under Tehran’s direction.

The French report states that Shahid Kaveh operates through numerous front groups posing as vigilante hackers.

These front groups, including "CyberAveng3rs" and "Cyber Isnaad Front," are tasked with publicly claiming responsibility for certain attacks carried out by the Shahid Kaveh unit.

Two of the alleged associates, Hamid Reza Lashgarian and Mahdi Lashgarian, have previously been sanctioned by the US over alleged ties to the IRGC’s cyberunit.

Iran’s cyber capabilities and targets

Iran has extensive cybercapabilities that it is increasingly using to advance its wartime objectives.

A senior fellow at the Center for Strategic and International Studies (CSIS), Nikita Shah, notes a "notable uptick in Iran’s cyberoperations since March 2026".

These operations include cyberespionage and conflict-themed cybercrime.

A 2025 policy report by the UK Parliament’s Intelligence and Security Committee describes Iran as "an aggressive cyberactor with extensive capabilities".

While Iran’s cybercapacity is not as sophisticated as Russia’s or China’s, Tehran is adept at using basic exploitation methods against its adversaries.

The report notes that Iranian cyberactors often use simple computer network exploitation techniques, which they use very effectively.

These techniques exploit basic vulnerabilities that many organisations have, including in the UK.

Cyberoperations are also a "deniable tool" that Iran can use to "attack its enemies, respond to perceived aggression and project power in the region – and globally".

The recent French intelligence report said attacks by Shahid Kaveh and its affiliated groups have been "primarily directed against Israel and the United States, but also against France and other European countries".