Iranian Hackers Target Global Refrigeration Systems, Spoiling Food at U.S. Bases and European Stores
Cyber Isnaad Front is behind a series of attacks on industrial cooling units, disrupting operations from Israeli plants to French supermarkets and American military commissaries.
By Andrew Bennett ·
Iranian military hackers known as Cyber Isnaad Front are conducting a coordinated campaign to compromise industrial refrigeration systems, causing physical damage to machinery and spoiling food across three continents. The group has targeted facilities in Israel, the United States, and multiple European nations over the past six months.
The attack pattern began in May at a large Israeli food production plant. Employees noticed office printers outputting threatening messages, then discovered malicious code on corporate computers. An engineer later found smoke rising from industrial freezers, which contained broken compressors and spoiled inventory. Operations at the site ceased for more than a week while replacements were sourced from abroad. Omri Segev Moyal, head of the incident response firm Profero, stated that the hackers manipulated safety limits, opened gas pressure valves, and disabled alerts to destroy the equipment.
The group has since expanded its reach. In August, U.S. military commissaries experienced what the Pentagon described as possible refrigeration disruptions. At least nine locations reported outages, though the Department of Defense has not officially confirmed a cyberattack. In October, French supermarkets were hit, and early November saw attacks on stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium. Moyal described the sequence as targeted attacks practiced against Israel, tested in Europe and the U.S., and then unleashed globally.
Technical analysis suggests the hackers exploited aging Danfoss remote control systems. Public contracting documents show that the U.S. Defense Commissary Agency uses older versions of these controllers, some from the mid-2000s, that cannot receive secure software updates. French officials identified the same Danfoss machines as the vector for the supermarket hacks. Danfoss advised customers to install latest firmware, remove devices from the internet, and operate behind firewalls and virtual private networks to mitigate risks.
Ari Ben Am, co-founder of Telemetry Data Labs, tracks the group's activities on Telegram. He noted that Cyber Isnaad Front operates with a higher level of investment than other Iranian hacking groups. Ben Am concluded that the hackers may have shared wiper malware tools with other groups, such as Cyber Av3ngers, which previously targeted water treatment facilities in the U.S. in 2023. The group has also used human actors in propaganda videos to publicize their successes.
The October propaganda video for the Israeli grocery store hack featured a masked man in a room filled with screens. The video displayed surveillance footage of affected customers and employees. In Arabic, the hackers claimed the attack was launched for the children of Gaza. The clip ended with a salutation to French students, a reference that preceded the French supermarket attacks by weeks. Josh Corman, a former Cybersecurity and Infrastructure Security Agency official, warned that connecting industrial refrigeration to the Internet exposes critical infrastructure to adversaries. He noted that while current attacks hit food, future strikes could target temperature sensitive drugs and laboratory materials.
