Cold Chain: Iranian hackers target refrigeration systems on U.S. military bases

Investigators are treating recent refrigeration outages at U.S. military commissaries as a cyberattack, with evidence pointing toward an Iranian hacking group. The Defense Criminal Investigative Service is collaborating with the Army Criminal Investigation Division and French law enforcement to trace the disruptions. While the Pentagon has not officially confirmed the cause, two former officials familiar with the probe said the agency suspects Iranian actors are responsible.

The incidents form part of a global wave of attacks on industrial cooling systems. In August, at least nine Defense Commissary Agency locations experienced disruptions. Fort Huachuca in Arizona and Fort Irwin in California both reported equipment failures that forced freezers into defrost mode. Fort Huachuca stated on social media that the failure heated up all food, resulting in spoilage, and confirmed that no power outage occurred during the event.

Cybersecurity experts attribute the attacks to a group called Cyber Isnaad Front. Ari Ben Am, a threat intelligence co-founder who has tracked the group for years, said the actors work on behalf of the Iranian military. He described the group as highly capable, noting that they effectively compromise organizations with established cyber defenses. Ben Am said the group may share tools with other Iranian entities, including the Cyber Av3ngers, which previously targeted water treatment facilities in the United States in 2023.

The attacks have expanded beyond military targets. In October, French supermarkets reported similar incidents. In early November, food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium experienced disruptions. IKEA was among the affected retail locations. Omri Segev Moyal of Profero, an Israeli incident response firm, said the hackers tested their methods in Europe and the United States after building capabilities in Israel.

Technical reviews of government contracting documents reveal that multiple U.S. military installations use Danfoss remote control systems for refrigeration. Some of these units date to the mid-2000s and can no longer receive software updates. French officials identified the same Danfoss hardware as a vector for the supermarket hacks. A Danfoss spokesperson said the company is in contact with affected customers and advised them to install the latest firmware or remove devices from the internet.

The sophistication of the attacks has increased due to access to artificial intelligence. Moyal said the hackers rapidly tested various system configurations to destroy compressors, a volume of changes that would be difficult for a human to achieve manually. The group released a propaganda video in October showing masked actors and hacked surveillance footage. The video, labeled with a red triangle logo, claimed the attack was launched on behalf of starving children in Gaza and saluted French students.