What Is Shahid Kaveh? Iran’s IRGC Cyber Unit Explained

Shahid Kaveh is an attack unit inside the IRGC-CEC. The Paris prosecutor, Laure Beccuau, describes it as “an offensive cyber unit affiliated with the Electronic and Cyber Centre of the Islamic Revolutionary Guard Corps.”

The IRGC-CEC is the Guards’ cyber and electronic warfare arm. The U.S. Treasury placed it under sanctions on January 12, 2018, as an entity acting for the IRGC. Shahid Kaveh works inside it. France’s cyber crisis coordination center says the unit runs large-scale campaigns against industrial equipment for the purpose of sabotage, aimed mainly at Israel and the United States, and also at France and other European countries.

“Shahid” means martyr, a word that opens the names of many IRGC units. Nothing about the unit’s size or budget is on the public record.

France says the unit took remote control of refrigeration controllers at about 700 retail and food sites on the night of October 11 to 12, 2026, and set them to overheat.

According to the Paris prosecutor, the attackers reached the equipment through its web interfaces, started “abnormal, indefinite defrost cycles” and switched off the temperature alarms at the same time, so staff were not warned. Supermarkets had to throw away whole stocks of chilled and frozen food. French investigators count at least 15 fires caused by the overheating equipment.

Barrot called the attack “unprecedented in both its scale and its level of aggression” and “the first large-scale cyberattack aimed at sabotage on our national territory.” France summoned Iran’s ambassador and says it will seek sanctions at European Union level. Grocery freezers in other European countries were reported hit on November 2; France has attributed only the October attacks on its own territory.

France’s case rests on technical traces. It is a government assessment, not a court finding.

The French cyber agencies’ five-page report lists four main indicators. The attackers reused digital infrastructure that had also been used to scan Schneider Electric industrial systems at small energy and water sites. They used FOFA, an internet device search engine the unit relies on. Farsi-language traces were found on their servers. And the attacks were claimed on October 13 by CyberbanNews, an online outlet France ties to the unit. The prosecutor added that IP addresses led back to terminals in Iran.

The report also says Shahid Kaveh has worked through Modbus, a common industrial control protocol, since at least April 2026.

Yes, on France’s account: CyberAv3ngers is one of several online identities Shahid Kaveh uses, alongside names such as Soldiers of Solomon.

CyberAv3ngers is the persona U.S. agencies blamed for the first well-documented IRGC attacks on American water systems. A joint advisory by the FBI, CISA, NSA, the Environmental Protection Agency and Israel’s National Cyber Directorate, first issued on December 1, 2023, says IRGC-affiliated actors began breaking into U.S. water and wastewater facilities on November 22, 2023. They broke into Israeli-made Unitronics controllers left with default or no passwords and posted an anti-Israel message on their screens. The advisory, updated in December 2024, counts at least 75 compromised Unitronics devices in the United States between November 2023 and January 2024, at least 34 of them in the water sector. One victim, a small municipal water authority in Pennsylvania, had to switch a pumping station to manual control.

The same advisory notes that several of the persona’s claims of damage in Israel were false. That pattern matters for reading Shahid Kaveh’s claims today: its outlets announce more than investigators later confirm.

France names three men: Hamid Reza Lashgarian, head of the IRGC-CEC, and Mahdi Lashgarian and Reza Salarvand, whom it identifies as the commanders of Shahid Kaveh.

Two of them were already under U.S. sanctions. On February 2, 2024, the Treasury designated six senior IRGC-CEC officials over the Unitronics attacks, including Hamid Reza Lashgarian, whom it described as head of the IRGC-CEC and a commander in the IRGC-Qods Force, and Mahdi Lashgarian. In August 2024 the State Department’s Rewards for Justice program offered up to $10 million for information on the same six. Paris prosecutors have opened a judicial investigation into the unit’s leadership and have asked for international arrest warrants.

Before 2026 the unit was best known from documents leaked in July 2021. Western security sources said they came from Shahid Kaveh and from a sub-unit called Intelligence Group 13.

The 57 pages, five research reports mostly dated 2020, studied whether the ballast and water systems of cargo ships could be tampered with remotely, and whether fuel gauges at petrol stations could be manipulated to cut supply or overheat the fuel. Analysts who reviewed them said they showed an interest in simple, opportunistic attacks built largely on public information. No government has confirmed the files publicly, and their authenticity has not been independently established.

In March and April 2026, in the first weeks of the war, the unit’s personas claimed sabotage against Israeli and U.S. targets, including Israeli refrigeration equipment. France’s report separates Shahid Kaveh from a second IRGC-CEC unit, Shahid Shoostari, also known as Emennet Pasargad, which France links to the January 2023 hack of Charlie Hebdo’s online shop and to a July 2024 compromise of a French display company before the Paris Olympics.

Iran denies it. Its foreign ministry said on November 10 that it “categorically rejects the French government’s baseless and one-sided accusations” and warned it would take “necessary and appropriate measures” to protect its interests.

Foreign Minister Abbas Araghchi said on X that the French government was “shifting blame for its failures onto others.” On the European side, EU foreign policy chief Kaja Kallas said “our response should be strong,” and an EU spokesman said the bloc was ready for “a swift and united response” once member states agree. No EU sanctions had been announced as of November 11, 2026. The cyber campaign runs alongside the IRGC’s war at sea, where its navy claims mine and tanker attacks that we check against confirmed incidents in how many tankers have hit mines in Hormuz and in our Strait of Hormuz status tracker.