France has accused Iran of sabotage. I love a good attribution, so I went looking for the evidence.

I found a port number.

One port number on one night.

A port for a day.

Are you Frenching kidding me?

That took me back to an incident briefing I led in San Francisco many years ago. The room was packed. Everyone was on the edge of their seat, except one guy. He slouched back and kept shaking his head no. I was walking the room through what we had found when suddenly he stood up and said he had seen the classified version, we don’t get it, and he marched out smiling at us like a Cheshire cat. He declined to say anything useful. He declined to say what the classified data corrected. He flamboyantly checked out, and the room was left to choose between the evidence and the confidence of a man who wanted us to believe it wasn’t enough.

The absence of evidence isn’t the evidence of absence.

France has just played that annoying man at the back of the room with his giant shit eating grin, and people have been taking the report way beyond face value.

A port number. Let me say it again.

An accusation built on a port and covering one night has been read as some kind of grandiose verdict on a month of attacks across a dozen countries. The gap between what Paris published and what the press now believes is the big story here, and it is easy to drag out of its neanderthal cave of lizard brain attribution into the sunlight of modern science.

Start with the official statement. On 9 November the foreign ministry named the Revolutionary Guard unit Shahid Kaveh for the attack on refrigeration controllers at about 700 French stores on the night of 11 October, called it “inédite par son ampleur et son niveau d’agressivité,” and announced it at a G7 press briefing minutes after Reuters reported that investigators privately suspected Iran. The five-agency C4 published a five-page note the same day. It calls its evidence a faisceau d’indices, the French legal term for circumstantial evidence.

It covers one country, and one night. That’s it. Here is the whole case:

• The attack infrastructure also scanned Schneider Electric equipment over Modbus on port 502, a technique the note associates with Shahid Kaveh from April 2026.
• The operators used FOFA, a Chinese commercial search engine for internet-connected devices.
• The propaganda channel CyberbanNews relayed the attack on 13 October. The note’s word is relayée.
• Farsi traces appeared in the attack infrastructure.

The port. Oh, the port.

CISA AA26-097A of 7 April 2026, signed by six US agencies, tracks CyberAv3ngers as the Shahid Kaveh Group and lists its traffic on ports 44818, 2222, 102, 22 and 502. Those are ports that any control-systems scan is going to reference. The American advisory ships indicators of compromise, the addresses a defender can match against logs. The French note matched the technique and kept the indicators. Had the infrastructure matched, the note would say infrastructure. It says technique.

FOFA is a subscription product and Farsi strings are the easiest artefact of all to plant; Olympic Destroyer carried a forged header copied from North Korean malware for the same reason. It’s like meeting a Russian guy with a beard glued on speaking a few words in Farsi. Speaking of which, on Halloween I met an Iranian teen who had personally made his own very authentic looking Soviet-era army general uniform, complete with insignia and Afghanistan war medals. He knocked and then refused candy, saying it was a bribe against Communist principles. Talk about a convincing costume.

That leaves the repost, the one item specific to Iran, and the note undercuts it itself: the unit’s avatars exist to claim attacks, and for this one their outlet relayed.

The prosecutor added a fifth item when she gave her presentation of the report, IP addresses pointing to terminals located in Iran.

The C4 note has Iranian addresses in one place, the 2024 Olympics kiosk case, under a different unit. For the October attack her own agencies list none. Her fifth item is absent from the document she was presenting. Two of the three names in the annex are on the US Treasury list of 2 February 2024. The names came from Washington, and this evidence says the same about where the verdict comes from. France is relaying an American judgment, which it is leaving as unverifiable.

Of course, it’s only cyber champagne if it comes from the Champagne region of France. Otherwise it’s just sparkling American intelligence. I mean this seems like a case of appellation d’origine contrôlée: the label is French, the grapes were pressed in Maryland. By French law it’s only Iran war attribution if it comes from Fort Meade.

Some of my readers may remember over a decade ago when Russia stood as the accused and I batted the other direction. In 2014 Bloomberg reported that US intelligence officials believed Russia blew up the Baku–Tbilisi–Ceyhan pipeline in 2008 by hacking its cameras. I pointed to the Corner House analysis attributing the blast to the PKK, and Süddeutsche Zeitung later reported an audit showing the cameras were installed after the explosion. “Unprecedented” has the same history: Ralph Langner, who reverse engineered Stuxnet, called the attack very basic, and Maroochy had put sewage in Queensland’s parks a decade earlier.

Same test, whoever is accused: publish what can be checked. Don’t laugh at the room and say you have a secret squirrel solution in your hideout nobody can see.

Now the merger. The same evening a Wavestone partner told the Guardian: “Given that recent cyber-attacks on supermarkets and the blood bank in France concerned freezers it is reasonable to think Iran is directly linked to both.” One night became a month based on the simple fact that both one day and many more days involved freezers. The EU High Representative said the incidents “if attributed” called for a strong response. That’s a strong conditional, and unfortunately she seems like the only official using it.

The method belongs to everyone.

Forescout cites a Danfoss newsletter recording hacktivist attacks in 2022 on 16 Russian supermarkets and 40 Israeli stores, and tracked more than twenty claimed refrigeration attacks between January and October 2026, chiefly in Spain and Italy, with the pro-Russian Z-Pentest Alliance and NoName057(16) the most active. By the time France was hit, Russian-aligned groups had spent nine months rehearsing on European cold storage.

Nine months of Russian attacks isn’t for nothing.

The October attack and the November wave are written up here already.

It belongs to everyone because the vendors built it that way. This is one of the most annoying parts to this story. The vendors need to have WAY more accountability. Regulators really need to get on them like how PCI DSS hammered card systems in the 2000s to force safety innovation in both the distribution and acquisition ends of their industry. Known weakness? Don’t ship weak devices. Don’t connect weak devices. If you do, no more shipping and connecting for you.

On 20 May 2025 CISA published CVE-2025-41450 for the Danfoss AK-SM 8xxA, an authentication bypass “caused by datetime-based password generation.” Claroty’s Team82 published the mechanism in August 2026: the controller accepts a code of the day in place of the administrator password, and the code is derived from the device’s own calendar. Copeland’s XWEB Pro, the other platform on CERT-FR’s list, has the same design, CVSS 10.0. Most of the October victims ran Danfoss models the vendor stopped updating in 2021 and 2016. And France had the most of them: IPinfo found 1,331 Danfoss dashboards open in France five days before the attack, against 1,197 in the other 72 countries combined, on the same firmware mix as everywhere else.

The vendor decides the controller attaches to the internet. The store that owns the food has no way to force safety on the vendor.

The vendor decides.

The vendor.

Decides.

November looked different. More than 100 stores in at least nine countries, plus cold rooms at three sites of the French blood service through a rental contractor. Ransom-ISAC logged one XWEB site hit with the factory login. Sekoia’s Danfoss honeypots the same evening caught an undisclosed exploit. Two operators at least. Sekoia is the only vendor to have published an infrastructure analysis spanning both waves, and it judges the two “may have been conducted by the same threat actor” while stating that “no technical indicators currently link this incident to that cluster,” the cluster France named. One actor, with nothing technical to link it to Tehran. Sekoia’s motive hypothesis, France’s deployment of troops and air defence to the Yanbu oil terminal as announced 24 September, gives Iran a reason. But it gives a defender nothing to verify.

Then the Russian claim arrived and vanished. Poof!

Or as I like to say, the poof is the proof.

NoName057(16) and Z-Pentest claimed November in a Telegram video and deleted the channels. Sekoia calls the claim unsubstantiated on three grounds. Two describe NoName, its history of false claims and its DDoS profile. The third is that the leaked credentials look like infostealer logs, which is also how an attacker gets contractor logins for these controllers. Z-Pentest made the claim too, and Z-Pentest is the group known for control systems; Forescout tracked it as the year’s most active claimant on refrigeration, and Denmark’s Defence Intelligence Service attributed a 2024 waterworks attack to it. The groups that practiced this all year claimed it, then erased the claim. That is the pattern: the operation that succeeds leaves the case open and the blame elsewhere.

France could be right about Iran. Could be… but what they published is a port number, and that ain’t right. It undermines credibility, if anything.

Imagine someone saying that some moldy cheese must be from France just because it tastes like old socks. Ok, but shouldn’t we have some actual tests before we slap a “made in France” label? The UK has actually landed in this spot already when they discovered that 100% of their real English honey from real English bees labels are bullshit, and they’ve been swallowing sweet impostor sauce for years. Literally 10 out of 10 jars failed the authenticity test, which should have been required a long time ago. Regulation is the mother of innovation:

Honey is one of the most adulterated food items on the market. We provide full traceability; we highlight 1. the location – area, country – from which we source our honey; and 2. the communities that manage our hives.

Anyone talking about a month of attacks solved is skipping all the parts where we prove who the attacker actually was and will be. The actual known culprits already proven are the vendors. They shipped a calendar password into internet-facing fridge controllers. And they forced it to be used in an unsafe state. Who should be blamed? The vendors. And probably Russia, if we get to that state of evidence. But in the meantime, the vendors.