The hybrid war in Europe takes a very concrete form with the sabotage of commercial refrigerators. On November 9, 2026, Paris attributed the French attack of October to a unit of the Iranian Revolutionary Guards. Prorussian collectives had claimed similar attacks. North Korea appears in other cases. Behind this succession of names, several operations, organizations and degrees of certainty must be distinguished.
The French announcement provides a response on the designated perpetrators of a specific attack. It does not solve all the intrusions that have affected European refrigeration plants. Nor does it derive their value from previous assignments in Moscow or Pyongyang in other cases. The decisive point is to identify, for each episode, the facts observed and what the investigations actually make clear.
October and November: two waves not to be confused
The first wave hit mainly France on the night of 11-12 October 2026. Attackers remotely change the parameters of refrigeration controllers. Approximately 700 large distribution sites are affected. The consequences go beyond computer unavailability: operators lose goods and have to control their facilities before returning to normal activity.
A new wave occurred on the night of November 1 to 2. It concerns several other European countries. Trades report similar disturbances, notably in Belgium and Sweden. The proximity of dates, equipment and effects favours the idea of a unique campaign. However, it does not provide technical demonstration.
On 9 November, the French award explicitly targeted the October attack on French refrigeration controllers. The origin of the second wave remains distinct in the public information consulted on that date. An investigation must establish possible links between episodes. The same type of aircraft may be of interest to several attackers, especially when comparable installations have the same protection defects.
Shahid Kaveh, an Iranian unit behind several names
The French services designate the cyber-offensive unit Shahid Kaveh as performing the October attack. They link it to the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps. Their report appoints two officials, Reza Salarvand and Mahdi Lashgarian. It thus describes a structure linked to a state apparatus, not just a gathering of digital activists.
This unit appears under various public identities: CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. These names are used in particular to claim certain transactions. CyberbanNews plays a communication role. A reader can thus meet several signatures without necessarily dealing with several autonomous organizations.
The targeting of industrial equipment is a central element of its activity. The precedents presented by the French authorities concern in particular Israel and the United States. They mention industrial control equipment and refrigeration systems. This path makes the mode of action consistent with the capabilities assigned to the unit. However, it does not dispense with establishing responsibility for each new attack.
Another Iranian unit for Charlie Hebdo and the Olympics
The French file also cites Shahid Shoostari, known as Emennet Pasargad and d’Iliyanet. It must be distinguished from Shahid Kaveh. The authorities link it to other operations against French interests, in a logic of intimidation or destabilization. Sharing an institutional connection does not mean that the same teams lead all attacks.
In January 2023, Charlie Hebdo’s online shop underwent a disfiguration and data exfiltion. The newspaper then published cartoons by Ali Khamenei. The French services now assign this operation to Shahid Shoostari. The objective here goes beyond the malfunction of a commercial site: the editorial context is part of the targeting described by the authorities.
From 20 July 2024, a French company managing video display terminals experienced another compromise. The attackers seek to broadcast montages denouncing the participation of Israeli athletes in the Paris Olympic Games. The discovery of intrusion occurs before their display. This precision counts: a foiled attempt should not be described as a campaign actually broadcast.
Prorussian collectives who claimed the refrigerators
NoName057(16) and Z-Pentest were among the groups that claimed the cold attacks on Telegram in early November. Their communication fueled the Russian track in the public debate. However, a specialized analysis published before the French allocation described these claims as unverified. The publicity given to an operation alone does not constitute proof of participation.
NoName057(16) is distinguished mainly by so-called DDoS attacks. They consist of submerging a query service to make it difficult to access. Governments, companies and institutions of countries supporting Ukraine have been among its targets. The international police operation Eastwood, conducted in July 2025, targeted its network and infrastructure.
The group relies in particular on DDoSia, a mechanism that facilitates the participation of sympathizers. The organisation can thus allocate the effort among several contributors. This operation differs from the sabotage of an industrial controller. An actor can develop new capabilities or collaborate with others, but his reputation in one category of attacks does not prove his responsibility in another.
Z-Pentest and CARR: Russian links to describe precisely
Z-Pentest focuses more on operational technologies, those that control physical equipment. International assessments describe him as being from members of NoName057(16) and Cyber Army of Russia Reborn, or CARR. Its creation dates back to September 2024. The water and energy sectors are among its known targets.
On 13 July 2026, the Council of the European Union imposed sanctions on Z-Pentest. He cited in particular an attack on a Danish water distribution service in December 2024. This decision documents a concrete European precedent. It is not valid for early validation of any claim subsequently published by the group, particularly on refrigerators.
Relations with the Russian State are not limited to a single formula. An international opinion of December 2025 considers that the GRU probably supported the creation of CARR. He describes NoName as a project linked to the Russian CISM Center. The same document presents the formation of Z-Pentest as distinct from the involvement of the GRU. These nuances prevent all pro-Russian collectives from automatically being assimilated to military units receiving the same orders.
Why Russia has already been charged in other cases
The charges against Moscow are not based solely on statements by digital collectives. Certain transactions have been the subject of specific public allocations. On 29 April 2025, France designated Russian military intelligence, the GRU, for several attacks carried out with MOP APT28. This term includes techniques and infrastructures followed by investigators.
Paris cited the sabotage of TV5World in 2015 and the attempt to destabilize the French electoral process in 2017. The statement also referred to the targeting or compromise of some ten French entities since 2021. These included public services, businesses and a sports organization linked to the 2024 Games.
Another precedent concerns NotPetya, the destructive attack of June 2017. The United Kingdom allocated it to the Russian army in February 2018. The British authorities considered this responsibility almost certain. These files cover identified transactions and dated evaluations. The allocation of refrigerators to an Iranian unit does not contradict them: several states simultaneously conduct different offensive activities.
North Korea appears in flights and WannaCry
No official attribution of cold attacks to North Korea appears in the public elements consulted for this file. His name, however, refers to several major operations, some of which have recently taken up the news. Confounding them with the fridges would create a false succession of suspects in the same investigation.
In May 2017, WannaCry disrupted organizations in many countries, including the British health care system. On 19 December, London declared highly probable the responsibility of North Korean actors known as Lazarus. This assignment concerns the ransomware campaign. It does not describe an operation against the cold chain.
The FBI also attributed to the North Korean TraderTraitor activity theft of some $1.5 billion from Bybit in February 2025. On October 31, 2026, he challenged the same activity in the theft of more than six billion at Binance. The press release places this last episode around October 29. These are cryptoactive cases, with separate victims and mechanisms.
The objectives can therefore vary greatly. Stealing funds, gathering information, disrupting an election and damaging an industrial facility are not interchangeable transactions. A State may pursue several of these objectives. For the reader, the name of a country must always remain associated with the specific incident that the authorities attribute to it.
Reciting, assigning, judging: three different approaches
The claim is first of all a declaration by the actor who presents himself as responsible. It can be accurate, exaggerated or false. Collectives sometimes seek visibility by broadcasting videos or screenshots. These elements must be brought closer to the technical journals, the timetable and the actual consequences of the victims.
Technical allocation seeks continuity: infrastructure used, methods, tools and behaviour. LANSSI points out that the borders between state and criminal actors are blurred. The use of shared tools, misused legitimate services or false leads complicates reconciliations. A server address or language is not enough to identify a government.
The public award then involves a political authority on the basis of the information available to it. Another objective of the criminal procedure is to establish individual responsibilities according to judicial rules. Judicial information or a request for an arrest warrant does not constitute a conviction. In the French case, this distinction must accompany the presentation of the respondents.
Hybrid war in Europe also targets daily services
The term refers to a combination of means to weaken an opponent or influence his or her decisions. It can combine cyber attacks, information manipulation, sabotage, economic pressure and military actions. In particular, actors seek to exploit the vulnerabilities of a society and make the response more difficult. Uncertainty about the author is sometimes part of this difficulty.
Hybrid war does not imply the absence of fighting. Illegal operations can prepare, accompany or prolong an open war. On 24 February 2022, an attack struck the KA-SAT satellite network, operated by Viasat, one hour before the Russian invasion of Ukraine. The disturbances concern Ukraine and several European Union countries.
On 10 May the Union allocated the operation to Russia. This case shows the possible articulation between digital disruption and military offensive. It differs from an opportunistic attack for ransom. The qualification of hybrid threat depends on the context, objectives and coordination of means, not only the existence of computer damage.
Refrigerators make another vulnerability visible: digital now controls the basic equipment needed. An intrusion can destroy stocks without physical penetration into a store. It can impose audits, interrupt activity and mobilize public services. These effects give sabotage a range that goes beyond the screen of the compromised computer.
Disorganization can count as much as destruction
The European institutions describe campaigns to weaken confidence and influence political decisions. In March 2026, the Council again denounced Russian hybrid activities against the Union, its Member States and its partners. In particular, he stressed their effects on the cohesion of societies and on support for Ukraine.
In this perspective, an attacker can look for several effects from a limited incident. Economic losses are a first result. Media attention and concerns about continuity of services can amplify its scope. However, this general logic must be distinguished from a particular demonstrated objective. Public elements on refrigerators do not reveal all the precise intentions of their authors.
Caution also avoids reading that makes each breakdown a coordinated hostile act. Accidents, technical defects and lucrative crime exist. Similar incidents may come from different actors. Demonstrating a campaign requires more than a coincidence of dates or than a supposed political benefit to a state.
Protect the cold without waiting to know all the authors
The technical response does not depend on the definitive conclusion on the identity of the attackers. The public recommendations stress the limitation of the exposure of industrial equipment to the Internet. They also call for enhanced authentication, access inventory and system monitoring. Companies need to know who can change the parameters and by which path.
Access to maintenance requires work with service providers. Protection should cover the entire chain, not just the store. Operators also need procedures to verify post-incident settings and restore the service to safety. Making an interface accessible again does not guarantee that the installation works properly.
Politically, Paris announced a diplomatic response and called for European sanctions against those responsible for the October attack. The judicial investigation must specify the individual responsibilities. Another point remains open on 9 November: the identification of the authors of the European wave of early November and its possible links with the first campaign.
Illustration: European Commission in Brussels. Credit: Jai79 / Pixabay, photograph preserved in the Libnanews media library.
Comments