CyberAv3ngers (Shahid Kaveh)
An IRGC-linked unit that attacks industrial controllers left open to the internet, from water utility PLCs to supermarket refrigeration. France blamed it on 9 November 2026 for sabotage at around 700 retail sites that sparked at least 15 fires.
Threat actor profile. Last reviewed 11 November 2026.
Why It Matters
The group's signature is finding industrial controllers left open to the internet and changing what they do. US agencies counted at least 75 compromised Unitronics devices in the US between November 2023 and January 2024, at least 34 of them in water and wastewater. The NCSC, a co-author of that advisory, also observed PLC targeting in the UK.3
Its targeting has widened. A US joint advisory first published in April 2026 and updated in July covers Rockwell Automation, Schneider Electric and Siemens PLCs, where changes to project files and HMI displays caused operational disruption and financial loss.2
In Europe the impact is now physical. France's Cyber Crisis Coordination Centre says the unit changed defrost settings on Danfoss refrigeration controllers overnight on 11 to 12 October 2026, hitting about 700 retail sites and sparking at least 15 fires, with losses in the tens of millions of euros.1 A second wave in early November reached more businesses across Europe, including British meat suppliers. France has not attributed that wave to Iran.4,1
This group does not need advanced exploits. It relies on controllers that should never have been reachable from the internet. Any business with refrigeration, building management or process controllers should know which of them are exposed and who can change their settings.
How It Attacks
Based on the 2023 joint advisory co-authored by the NCSC, French reporting on the 2026 attacks and the November 2026 US cold chain alert.3,1,5 Attackers change their methods often, so treat this as a typical pattern and not a fixed script.
- 1
Find Exposed Devices
Searches for internet-connected controllers. French investigators say the attackers used the FOFA device search platform.
- 2
Log In
Uses default or missing passwords. On Unitronics devices it authenticated over the default TCP port 20256.
- 3
Change What the Device Does
Has erased ladder logic, renamed devices and changed setpoints. In France it pushed defrost settings to high temperatures.
- 4
Lock Out the Owner
Has disabled upload and download functions and moved Unitronics devices to port 20257, making recovery harder.
- 5
Publicise the Attack
Defaces screens with political messages, and a linked outlet, CyberbanNews, publicised the French attacks on 13 October.
Key Techniques
These are our own mappings to ATT&CK for ICS, drawn from the advisories and French reporting.3,2,1 They are not copied from the group's ATT&CK entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T0883 | Internet Accessible Device | Initial Access | Reaches controllers exposed directly to the internet. |
| T0812 | Default Credentials | Lateral Movement | Logs in with default or missing passwords. |
| T0889 | Modify Program | Persistence | Erases or changes ladder logic on PLCs. |
| T0836 | Modify Parameter | Impair Process Control | Changes defrost and temperature settings. |
| T0832 | Manipulation of View | Impact | Changes data shown on HMI and SCADA displays. |
| T0828 | Loss of Productivity and Revenue | Impact | Causes food losses and halted operations at affected sites. |
Tools Observed
Devices Targeted
Reconnaissance
From the US advisories and French reporting.3,2,1 These are the products attacked. The main weakness was exposure and weak passwords, not a flaw in one vendor.
Key Events
At least 75 Unitronics devices compromised in the US, including 34 in water and wastewater.3
US, Israeli, Canadian and UK agencies publish a joint advisory, later updated in December 2024.3
The unit claims sabotage against Israeli and US interests, including Israeli refrigeration equipment.1
US agencies warn of PLC attacks by Iranian-affiliated actors, updated in July to add Schneider and Siemens.2 Reconnaissance of Schneider systems is seen, including in France.1
Refrigeration sabotage at about 700 French retail sites, with at least 15 fires.1
US agencies urge hardening of refrigeration and cold chain systems, without naming an attacker.5
France attributes the attacks to Shahid Kaveh, summons Iran's ambassador and opens a judicial investigation.4
Warning Signs
Drawn from the US advisories.3,5 None of these proves an attack alone, but each deserves a quick check.
- Controllers or HMIs that can be reached from the internet
- Logins to controllers from unfamiliar addresses or outside working hours
- Setpoints, defrost cycles or temperatures changing without an engineer's request
- Ladder logic, device names or firmware versions that changed unexpectedly
- A Unitronics controller now answering on port 20257
- Operators unable to upload or download programs
- Screens showing political messages or text nobody recognises
Defences That Matter
Take Controllers Off the Internet
- Remove public internet exposure, especially for controller panels.5
- If remote access is needed, put it behind an up-to-date firewall, VPN or gateway with MFA.5,3
- Keep OT devices on their own network, separate from business systems.5
Fix the Passwords
- Change default passwords and use strong, unique ones.5,3
- Allowlist the devices and addresses allowed to make changes.5
Watch the Setpoints
- Define sensible setpoint ranges and alert when they are exceeded.5
- Log access and review it. Where devices cannot log, capture the network traffic.5
Plan for Physical Impact
- Keep current, offline and tested backups of device configuration.5
- Keep spare hardware and rehearse running safely without remote control.3
Could Someone Change Your Settings From the Internet?
We can find your internet-exposed controllers and test how they are protected, then help you close the gaps.
Sources
- BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires, 9 November 2026
- FBI, CISA, NSA, EPA, DOE, CNMF and Treasury: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure, 7 April 2026, updated 22 July 2026 (AHA copy)
- FBI, CISA, NSA, EPA, INCD, CCCS and NCSC: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, AA23-335A, 1 December 2023, updated 18 December 2024
- The Record: report on France blaming Iran for the fridge cyberattacks, 9 November 2026
- CISA, FBI, HHS, USDA and DoT: US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems, 5 November 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.