The attacks that left supermarket freezers across France warming up in October now have a name attached. According to a follow-up investigation by Sekoia's threat detection and research team, French authorities on 9 November attributed the operation to Iran's Islamic Revolutionary Guard Corps, specifically the "Shahid Kaveh" unit tied to the IRGC Cyber Electronic Command. That unit is best known under its CyberAv3ngers persona, the group behind the 2023 compromise of internet-exposed Unitronics controllers at a US water utility.
The attribution answers the question left open when the attacks spread across Europe with no culprit named.
Two waves, hundreds of stores
Between 11 and 13 October, hundreds of supermarkets in France, including stores run by Intermarché and Coopérative U, had their Danfoss refrigeration controllers tampered with. On the night of 1 to 2 November a second wave hit refrigeration systems in around a dozen European countries, including Belgium, the Netherlands, Germany and Sweden. Sekoia reports that the same night, cold rooms at three sites of the French Blood Establishment were reprogrammed before staff intervened.
The attacker changed temperature settings, defrost cycles and alarm thresholds, the last of these so that maintenance staff would not notice for hours. Retail directors put the potential cost in the tens of millions of euros from spoiled food and lost trade.
The core problem was exposure, not sophistication. Sekoia counted more than 2,700 Danfoss systems reachable from the internet worldwide on 11 October, about 1,700 of them in France, most running outdated firmware with known flaws, including bugs Claroty's Team82 disclosed in August. By the afternoon of 12 October, roughly half of the exposed French systems had gone offline, which Sekoia attributes to victims pulling them from the internet rather than to wiping.
What Sekoia's honeypots caught
Sekoia stood up four decoy Danfoss 800A web interfaces in France and the Netherlands on 12 October. Within a day one received unauthenticated requests trying to enumerate connected units, which can reveal a store's identity and location if those details are in the controller's configuration. Over the following weeks, 26 unique IP addresses probed them, some spraying the Supervisor and admin accounts with the password "12345".
Online speculation pinned the first wave on CVE-2025-41450, a "code of the day" flaw disclosed by Claroty that lets anyone who supplies a date-derived code bypass authentication. Sekoia could not confirm it was used.
The one confirmed exploitation attempt came on 1 November, between 10:00 p.m. and 10:30 p.m., during the second wave. It targeted four honeypots with a previously unknown flaw that renames any user account, given only its numeric ID and without logging in. The attacker went after user ID 1, a full administrator. Sekoia assesses this was the first step of a chain: fixing the login name lets a second unauthenticated request reset that account's password. The second request was never seen because the first was blocked.
An LLM found the bug's purpose in minutes
The next day, Sekoia's researchers fed the captured request and Danfoss firmware images from the vendor's website to the GLM 5.3 model, which confirmed the rename primitive within minutes. Sekoia's point is uncomfortable: with one such bug, a list of exposed devices and a recorded browsing session of the web interface, an attacker could use an LLM to build a reliable exploit able to change settings on hundreds of controllers within minutes.
Sekoia also dismisses the responsibility claim posted by NoName057(16) and Z-Pentest as unsubstantiated, noting the DDoS crew's record of misleading claims and that the credentials it released look like aggregated infostealer logs.
Take the controllers off the internet
Sekoia's advice is blunt: remove refrigeration controllers and other ICS devices from direct internet exposure, put remote administration behind secure access, replace default credentials, apply Danfoss firmware updates, and monitor authentication and configuration changes. US agencies issued similar guidance last week.
Indicators observed in the 1 November exploitation attempt: 178[.]83[.]226[.]215 and 37[.]16[.]75[.]128.
The lesson goes beyond fridges. A state unit did not need sophisticated tradecraft to spoil food across a continent, only devices nobody had taken offline, and cheap AI tooling now narrows the gap between finding such a box and breaking it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.