France has officially linked last month’s supermarket refrigeration system sabotage to a cyber unit of Iran’s Islamic Revolutionary Guard Corps. In a separate development, A.P. Moller-Maersk has confirmed that attackers accessed and extracted data from an older system it inherited through an acquisition. Here’s a closer look at today’s major cybersecurity headlines.
France’s foreign ministry issued an official statement on Monday naming Shahid Kaveh, a cyber-offensive unit affiliated with the Revolutionary Guard’s electronic and cyber centre. The technical findings were published by CERT-FR, the French government’s computer emergency response team. They were prepared by a crisis coordination body involving the national cybersecurity agency, military cyber command and intelligence services.
The report presents several pieces of evidence linking the unit to the attack. The attackers used a search platform for internet-connected devices that CERT-FR says the unit regularly uses. The same infrastructure was also found scanning industrial control systems using techniques linked to the unit since at least April. Investigators also found Farsi-language text traces and IP addresses linked to devices in Iran. A propaganda outlet associated by France with Shahid Kaveh also publicised the attack as early as 13 October.
The attackers accessed refrigeration controllers overnight on 11 October and increased the defrost settings. This affected around 700 commercial sites and caused at least 15 fires. France’s cybersecurity agency says the attackers gained access through administration interfaces that were exposed to the internet and protected by weak passwords.
Paris prosecutors have requested international arrest warrants for the unit’s leader and his two deputies. France has also summoned Iran’s ambassador and says it will pursue European sanctions. Tehran, however, has rejected the accusations.
Sources: CERT-FR, BleepingComputer, The Hacker News
On Wednesday, Maersk disclosed that it had discovered unauthorized access and data extraction from a local legacy system inherited through a previous acquisition. The company said that its security team immediately investigated the incident and secured the affected system. Based on the findings so far Maersk believes it is unlikely that any sensitive data has been exposed.
The company described the incident was limited to only the particular system. It found no evidence of an impact on its wider infrastructure or on customer and partner systems. Maersk also expects its operations to continue without disruption.
However, the shipping group has not disclosed the system which was attacked and affected, what data was extracted, when the breach occurred or how the attackers gained access.
The disclosure came after the WhiteArmor extortion group listed Maersk on its leak site over the weekend. The group claimed to have stolen around 100 GB of data from a logistics platform that Maersk acquired in 2022. It also demanded $5 million in Bitcoin, with a payment deadline of 7 December.
Maersk has not confirmed any link between the incident and WhiteArmor. It has also not confirmed receiving a ransom demand or reported any file encryption. Researchers cited in media reports suggest that the available evidence points to data theft and extortion rather than a conventional ransomware attack.
Sources: Container News, Smart Maritime Network, GBHackers
Both incidents highlight the risks of leaving systems exposed or poorly monitored. In France, investigators traced a state-linked sabotage operation to administration interfaces accessible over the internet. In Maersk’s case, attackers stole data from a legacy system inherited through an acquisition.
Neither incident relied on a new attack technique. Instead, both show how exposed systems and overlooked security weaknesses can give attackers an opportunity to break in.
Stay vigilant and informed. Tune in tomorrow for more updates from InfosecTrain’s CyberWatch Daily!