Iran's Shahid Kaveh cyberunit poses as hacktivists, French intelligence warns

French intelligence agencies have revealed details of Shahid Kaveh, a cyberwarfare unit operating under the umbrella of Iran's Islamic Revolutionary Guard Corps, which has been conducting attacks on critical infrastructure across Western nations. According to French officials, the group employs a sophisticated operational model that masks state-sponsored activity behind independent hacker personas and front organizations.

The cyber unit has been linked to breaches affecting various sectors, with recent operations extending to compromises of industrial control systems and networked devices in France and allied nations. By adopting the guise of vigilante hacktivists, Shahid Kaveh has successfully obscured the state-directed nature of its campaigns, complicating attribution and response efforts.

French authorities characterize the operation as part of a broader Iranian cyber strategy to conduct espionage, sabotage, and disruption campaigns against adversaries. The revelation underscores the increasingly sophisticated methods employed by state actors to distance themselves from cyberattacks while maintaining operational effectiveness.

The disclosure coincides with growing international concern over state-sponsored cyber operations emanating from Iran. Security analysts note that the use of proxy personas and front groups represents an evolution in cyber tradecraft, enabling deniability while maintaining operational momentum against Western targets.