France names an IRGC unit for its supermarket sabotage, then declines to show its working

France’s Foreign Ministry said it had traced the night of 11–12 October sabotage of supermarket refrigeration controllers to “the SHAHID KAVEH cyber offensive unit, affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps.” Foreign Minister Jean-Noël Barrot, speaking at the G7 in Paris, called it “the first large-scale cyberattack aimed at sabotage on French soil” and said France would “impose sanctions at the European level against all those responsible.” Asked on Tuesday 10 November how France could be certain, Barrot said the determination had been made “with certainty” but declined to say how. The only public technical detail comes from Paris prosecutors, reported second-hand via AP: IP addresses tied to Iran, and attackers using Farsi. No ANSSI technical annex has appeared in open sources. The mechanism, per BFMTV, was simple — remote connection to refrigeration units, then switching on defrost cycles.

Tehran’s Foreign Ministry called the accusation “baseless and hostile” on 10 November, saying it was “intended to divert public opinion from France’s destructive policies toward Iran.” The ambassador summons was announced in the future tense in Monday’s ministry statement and executed on Tuesday, when Paris also said it would pursue European-level listings; several outlets collapsed the two days into one. Nothing retrieved indicates a sanctions proposal has been tabled, a legal basis chosen, or other member states signed on. The campaign affected roughly 700 of France’s 10,000 supermarkets — a France-only, October figure that is already being merged in coverage with a separate, later and entirely unattributed wave.

Assessment: Two tests sit over this. First, whether ANSSI publishes indicators or any other European CERT independently corroborates “Shahid Kaveh.” Farsi-language artefacts and Iranian IP addresses are among the easiest things in intrusion forensics to borrow, and a government that names a specific unit while refusing to explain how is asking to be taken on trust at precisely the moment it wants others to act. Second, announced is not adopted: EU listings require a legal basis and member-state consensus that no retrieved reporting shows exists. The political function of the attribution — a G7 week, a minister promising it “will not go unanswered” — is not evidence that it is wrong. It is a reason to want the annex.