--- title: Cold Front: Shahid Kaveh and the War on Refrigeration description: Treadstone 71 intelligence report on Shahid Kaveh, the IRGC cyber unit France named for the October 2026 sabotage of refrigeration controllers at about 700 stores. canonical_url: https://www.treadstone71.com/cold-front-shahid-kaveh language: en-GB date: 2026-11-12T16:15:53Z notice: This is a machine-friendly version of the page at https://www.treadstone71.com/cold-front-shahid-kaveh. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 1530 --- > **Note to AI:** This is a machine-friendly version of the page at: https://www.treadstone71.com/cold-front-shahid-kaveh. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. TREADSTONE 71 INTELLIGENCE REPORT // IRAN // IRGC CYBER ELECTRONIC COMMAND // NOVEMBER 12, 2026 Treadstone 71 Intelligence Report · Iran · Cognitive and Hybrid Warfare # Cold Front: Shahid Kaveh and the War on Refrigeration An Iranian state unit turned freezers into a weapon. France named Shahid Kaveh, an offensive unit of the Guard Corps’ cyber command, for the October 2026 sabotage of refrigeration controllers at about 700 French stores. The same method struck US military commissaries seven weeks earlier and stores across Europe three weeks later. By **[Jeff Bardin](https://www.treadstone71.com/jeff-bardin)**, Chief Intelligence Officer Published **November 12, 2026** 53 pages · Version 1.4 [Download the report (PDF)](https://www.treadstone71.com/files/T71_Intelligence_Report_Cold_Front_Shahid_Kaveh.pdf) [Commission an assessment](https://www.treadstone71.com/t71-contact-form)**3**waves against one device class in ten weeks **700**French retail sites hit on one night **19**standing judgments on the Sherman Kent scale **12**signposts to watch through March 31, 2027 ## What the report finds | Judgment | Band | |---|---| | Shahid Kaveh ran the October operation in France | *Highly likely (85 to <95)* | | The war that began February 28, 2026 set the timing and tempo of the campaign | *Highly likely (85 to <95)* | | An Iranian state operator ran the August attack on US commissaries | *Likely (55 to <85)* | | Another cold-chain event in the United States or Europe by January 31, 2027 | *Highly likely (85 to <95)* | | A medical cold-chain loss by March 31, 2027 | *Roughly even chance (45 to <55)* | ## Inside the report - The unit: chain of command, leadership, and a chronology from 2020 to 2026. - The campaign: three waves, the method at the level of effect, and the US commissary night. - The war as trigger: each escalation paired with the controller effect that followed. - What Telegram adds: the unit’s outlet, state relays, and leak channels, read in Persian, Russian, and English. - Analysis: patterns, trends, tendencies, aggregation, semiotics, forensic linguistics, and competing hypotheses. - STEMPLES Plus and Cultural Nexus readings of the unit and the campaign. - Estimates, five scenarios, cones of plausibility, signposts, and a ledger of what stays unknown. ## What to do now - Take refrigeration controllers off the public internet and reach them through a private link. - Replace default and date-based passwords with a unique secret per site. - Fit a temperature alarm that does not pass through the controller. - Staff a temperature watch on Sunday nights and holidays through January 3. Every source in the report carries two grades under the ASA Evidence Standard, reliability and credibility, shown apart. Verified facts and adversary claims keep separate rows. [Download the report (PDF)](https://www.treadstone71.com/files/T71_Intelligence_Report_Cold_Front_Shahid_Kaveh.pdf) [More Iran briefs](https://www.treadstone71.com/intelligence-briefs/iranian-briefs) ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@type": "Person", "@id": "https:\/\/www.treadstone71.com\/#person-jeffbardin", "name": "Jeff Bardin", "url": "https:\/\/www.treadstone71.com\/jeff-bardin" }, "dateModified": "2026-11-12T16:15:53Z", "datePublished": "2026-11-12T16:15:53Z", "description": "Treadstone 71 intelligence report on Shahid Kaveh, the IRGC cyber unit France named for the October 2026 sabotage of refrigeration controllers at about 700 stores.", "headline": "Cold Front: Shahid Kaveh and the War on Refrigeration", "image": { "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/t71cyberrecon.jpg", "alt": "", "width": 840, "height": 713 }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/www.treadstone71.com\/cold-front-shahid-kaveh" }, "publisher": { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher" }, "url": "https:\/\/www.treadstone71.com\/cold-front-shahid-kaveh" }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/www.treadstone71.com\/", "logo": { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo" }, "name": "Treadstone 71", "location": { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace" } }, { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/treadlogo-j2-4505e2a4.png", "width": 498, "height": 105 }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday" ], "opens": "00:00", "closes": "23:59" } ] }, { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Half Moon Bay", "addressRegion": "", "postalCode": "94019", "streetAddress": "", "addressCountry": "US" } ] } ```