Iranian Hackers Target Refrigeration Systems in U.S. Military Bases

The Department of Defense is treating refrigeration failures at multiple U.S. military commissaries as a cyberattack, with evidence pointing toward Iran. The disruptions, which occurred in August, affected grocery stores owned by the Defense Commissary Agency. While the Pentagon has not officially confirmed the attribution, the Defense Criminal Investigative Service and the Army Criminal Investigation Division are working with French law enforcement on the case.

Two former officials familiar with the investigation said authorities believe the outages were deliberate. They noted that while confidence in the Iranian attribution is not yet high, the pattern of the attacks aligns with a series of incidents across Europe. The investigation is ongoing, and the Pentagon has declined to specify exactly how many locations were compromised, though independent reports suggest at least nine sites experienced issues.

The attacks follow a similar incident in Israel in May, where a large food production plant suffered a multi-pronged cyberattack. Omri Segev Moyal, head of the incident response firm Profero, described the event as a destructive digital strike. Hackers accessed industrial controllers, adjusted safety limits, and opened gas pressure valves. The compressors were destroyed, and the plant’s operations halted for more than a week while parts were shipped from abroad.

Moyal identified the attackers as the Cyber Isnaad Front, a group linked to the Iranian military. He stated that the group used artificial intelligence to rapidly test system configurations until the equipment failed. The group released a propaganda video in October featuring a masked hacker and footage of spoiled food. In the video, the hackers claimed the attack was performed for the children of Gaza and saluted French students.

Since the Israel incident, hackers have targeted refrigeration controllers in various countries. Attacks have hit French supermarkets in October and food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium in early November. Ari Ben Am, a threat intelligence researcher, described the Cyber Isnaad Front as one of the more technically capable Iranian hacking groups he has seen. He noted the group has a history of compromising surveillance cameras and using human actors in promotional videos.

Contracting documents show that U.S. commissaries, including Fort Irwin in California and Fort Huachuca in Arizona, use Danfoss refrigeration remote control systems. These devices were identified by French officials as a vector in the October supermarket attacks. Some of the controllers in use are from the mid-2000s and can no longer receive secure software updates. Danfoss advised customers to update firmware, remove devices from the internet, and use firewalls to mitigate risks.

Fort Huachuca posted on Facebook that its commissary experienced an equipment failure that put all freezers into defrost mode, heating the food. The base clarified there was no power outage. Fort Irwin shared a similar report regarding its training center in the Mojabu Desert. Josh Corman, a former cybersecurity official, warned that as industrial systems become more connected, they are exposed to adversaries. He said the next targets could include temperature-sensitive drugs and laboratory materials.

The Cyber Isnaad Front is believed to have shared wiper malware with other Iranian groups, such as the Cyber Av3ngers, which targeted water treatment facilities in the U.S. in 2023. Ben Am concluded that the group is capable of compromising organizations with existing cyber defenses. The technical sophistication of these attacks is advancing, driven by access to AI tools that allow hackers to understand complex configurations quickly.