French officials blame Iran for refrigerator hacks, vow retaliation

By Raphael Satter and Gabriel Stargardter

PARIS, Nov 9 (Reuters) - French officials on Monday accused Iran's Revolutionary Guards of responsibility for the cyberattacks that knocked outcommercial refrigerators and freezers across France last month, saying there would be consequences for Iran.

The hacks that struck hundreds of French supermarkets in early October wereamong the most disruptive cyberattacks of the Iran war that began in February, a conflict that has been marked by scattered incidents of alleged digital disruption. These have included hacks againstthe Los Angeles transit system in March, against US water treatment plants in July and against ships bound for the United States in August.

Iran's mission to the United Nations did not return messages seeking comment. Iran routinely denies carrying out maliciouscyber operations.

The French announcement was made only minutes after Reuters revealed that investigators privately suspected Iran of being behind the attacks. French Foreign MinisterJean-Noël Barrot said the Iranian ambassador had been summoned to France's foreign ministry. Barrot also threatened further EU sanctions against Iran.

The effects of the October 11 hacks were dramatic. Some refrigerators had the temperature turned up so high they caught fire. In the hours following the incident, supermarket employees carted boxes full of perished meat and melted ice cream into giant trash containers. The attack's total costs could add up to tens of millions of euros nationwide, one French supermarket owner estimated.

The French hacks have since beenfollowed, this month, by a second wave of hacking that hit more than 100 establishments across Europe and even affected refrigerators used by French blood banks, prompting employees there to have to move some of the blood to different cold storage units.

SHAHID KAVEH

In a joint report issued by French spy andcyber agencies, officials accusedShahid Kaveh — described as a cyber offensive unit tied to the Revolutionary Guards — of being behind the hacking campaign, and named three alleged associates, Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.

The French report said the hackers worked through numerous front groups masquerading as vigilante hackers, including "CyberAveng3rs" and "Cyber Isnaad Front."

Reuters could not immediately locate contact details for the men, whose photographs were included in the report. Paris prosecutors said in a separate statement that they haverequested international arrest warrants aimed at the perpetrators.

The French said they were able to link Shahid Kaveh to the hacks by tying the incidents to the digital infrastructureused to sabotage the fridges, by matching the pattern of the intrusion to other hacks carried out by Shahid Kaveh and by recovering traces of Farsi in the attack infrastructure.

The report said that a total of 700 commercial sites had been targeted across France and that at least 15 fires had broken out as the hackers cranked up the heat. The report said that most of those affected were supermarkets but that the hacking also affected small butcher stores, a slaughterhouse and factories processing foodstuffs.

Government officials and tech companies on both sides of the Atlantic have been scrambling to get to the bottom of the hacks. Microsoft had privately tied Iran to the October cold-storage sabotage at least two weeks ago, according to three people familiar with the matter. Microsoft declined to comment.

US REFRIGERATOR HACKS

The sabotage of European supermarket fridges was preceded by at least one similar incident in the United States.

In August, refrigerators in at least six military commissaries went out of commission. Pentagon investigators are treating the malfunctions as a suspectedcyberattack and are working with French officials,Reuters reported last month. A person familiar with the matter said that the Pentagon considers Iran a suspect in the August commissary hacks but that the investigation is still in progress.

Reuters could not establish how the military made its determination or whether it was also looking into other suspects. That the US military considers Iran a suspect in the commissary sabotage campaign was first reported last monthby news website Nextgov.

The Pentagon said on Monday that it was "aware of speculation regarding a potential cyber incident" but it could not offer further comment for security reasons.

Iranian hackers allegedly have struggled previously to pull off hacks that trigger widespread disruption. The freezer sabotage was a notable exception, and this week it sparked warnings from US officials that more could be coming.

The hacks also appeared to have ​been easy to pull off,cybersecurity experts previously told Reuters. The firmbehind many of the stricken units said that several were obsolete or were running outdated firmware, which could have made it easy for hackers to break in.

Saher Naumaan, a senior threat researcher at the cybersecurity company Proofpoint, said in an email that the cold-storage sabotage was less a measure of Iran'scyber prowess than of"how exposed these systems are."

(Reporting by Gabriel Stargardter in Paris and Raphael Satter in Washington. Additional reporting by John Irish in Paris; editing by Chris Sanders and Will Dunham)