Cybersecurity: Iranian Hackers Target Global Refrigeration Infrastructure

Iranian military hackers operating under the alias Cyber Isnaad Front have executed a series of cyberattacks against industrial refrigeration systems in Israel, Europe, and the United States. The group, which Omri Segev Moyal of the incident response firm Profero links to previous influence campaigns in 2024, targeted critical infrastructure to disrupt operations and spoil inventory. The attacks coincide with rising tensions between Iran and Israel during a fragile ceasefire period.

Moyal confirmed the attribution based on forensic data and direct claims from the attackers. The initial major incident occurred at a large food production plant in Israel. Employees discovered threatening messages on office printers and malicious code on corporate computers intended to wipe internal data. An engineer later found smoke rising from industrial freezers caused by broken compressors. The facility remained offline for more than a week while engineers awaited replacement parts from abroad.

The technical execution of the attack demonstrated advanced capabilities. Hackers accessed industrial controllers, adjusted safety limits, and opened gas pressure valves. They disabled alerts and destroyed forensic evidence during the night. Moyal noted that the attackers used AI to rapidly test various system configurations, a volume of trials that human operators could not match. The compressors were overused until they failed, rendering them unrecoverable.

The scope of the campaign expanded rapidly following the Israeli strike. Unidentified hackers targeted refrigeration controllers in U.S. military bases in August and French supermarkets in October. In early November, attacks hit food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium, including locations operated by IKEA. Moyal described the pattern as a gradual buildup of attacks against Israel, followed by testing phases in Europe and the United States.

Josh Corman, a former Cybersecurity and Infrastructure Security Agency official, warned that connecting industrial refrigeration to the internet exposes critical systems to adversaries. He stated that while current attacks affect food, future incidents could target temperature-sensitive pharmaceuticals and laboratory materials. This vulnerability highlights the pressure on governments and companies to address long-standing security gaps in aging infrastructure.

In the United States, the Pentagon described the August events as a possible refrigeration disruption at multiple Defense Commissary Agency stores. While the agency has not officially confirmed a cyberattack, the Defense Criminal Investigative Service has partnered with the Army Criminal Investigation Division and French law enforcement. Two former officials said investigators treat the outages as a cyberattack and believe evidence points to Iran, though confidence in that attribution remains low.

Contracting documents reviewed by NPR indicate that several U.S. commissaries, including Fort Irwin and Fort Huachuca, use Danfoss refrigeration remote control systems. French officials identified these specific Danfoss machines as a vector for the October supermarket hacks. The documents show that some installations use older controller versions from the mid-2000s that no longer receive secure software updates. Danfoss advised customers to install the latest firmware, remove devices from the internet, and operate behind a firewall.

Fort Huachuca shared on Facebook that its commissary experienced an overnight equipment failure that put all freezers into defrost mode. A moderator clarified that no power outage occurred and that the switch to defrost mode heated the food. The account confirmed that the inventory was spoiled. Ari Ben Am of Telemetry Data Labs noted that Cyber Isnaad Front is one of the more technically capable Iranian groups he has observed, with a history of compromising organizations that possess cyber defenses.

A propaganda video released in October featured a masked man in a room of digital screens. The hackers claimed the attacks were launched on behalf of starving children in Gaza. The video also included a salute to French students, a reference that analysts link to ongoing education riots and the group’s past impersonation of a French far-right organization. The timing of the video release preceded the widespread attacks on French supermarkets, though a direct causal link remains unconfirmed.