Quick Summary
The Iranian threat actor Infy, also known as Prince of Persia, has re-emerged with new malware activity after nearly five years of silence. Recent attacks have targeted victims in Iran, Iraq, Turkey, India, Canada, and Europe, utilizing updated versions of malware named Foudre and Tonnerre. This resurgence highlights the ongoing risks posed by advanced persistent threats (APTs) and the need for vigilance against sophisticated cyber attacks.
The Securityish Brief
Infy, an advanced persistent threat (APT) actor with a history dating back to 2004, has resurfaced with renewed malware activity after a period of inactivity. According to SafeBreach, the group has targeted victims across multiple regions, including Iran, Iraq, Turkey, India, Canada, and Europe, using updated malware versions such as Foudre (version 34) and Tonnerre (versions 12-18, 50). The latest version of Tonnerre was detected in September 2025.
The group has shifted its attack methods, moving from using macro-laden Microsoft Excel files to embedding executables within documents to install Foudre. This change indicates an evolution in their tactics, making it crucial for users to be aware of potential phishing attempts that may deliver this malware.
Infy’s malware employs a domain generation algorithm (DGA) to enhance the resilience of its command-and-control (C2) infrastructure. This technique allows the malware to verify the authenticity of its C2 domains by downloading an RSA signature file, which adds a layer of complexity for defenders trying to disrupt their operations.
Additionally, the latest version of Tonnerre includes a mechanism to communicate with a Telegram group, which is used for issuing commands and collecting data. This highlights the innovative methods APTs are using to maintain control over their malware and infrastructure.
SafeBreach’s findings reveal that Infy has not only remained active but has also adapted its strategies to evade detection. This underscores the importance of continuous monitoring and updating security measures to protect against evolving threats.
Organizations and individuals should be particularly cautious of unsolicited emails and attachments, as these are common vectors for malware delivery. Regularly updating software and employing robust security practices can help mitigate risks associated with such advanced threats.
Key Takeaways
- Be cautious of unsolicited emails and attachments, as they may contain malware like Foudre.
- Regularly update your software to protect against vulnerabilities exploited by advanced persistent threats.
- Monitor your systems for unusual activity that may indicate a malware infection.
- Implement strong email filtering to reduce the risk of phishing attempts.
- Educate your team about recognizing suspicious communications to enhance overall security awareness.
Key Terms & Concepts
- Infy: In this article, Infy refers to an Iranian advanced persistent threat (APT) actor also known as Prince of Persia.
- Foudre: Foudre is a downloader malware used by the Infy group to deliver a second-stage implant called Tonnerre.
- Tonnerre: Tonnerre is a malware variant that extracts data from high-value machines and is delivered by Foudre.
- Domain Generation Algorithm (DGA): DGA is a technique used by malware to create a large number of domain names to evade detection.
Read the original article here: https://thehackernews.com/2025/12/iranian-infy-apt-resurfaces-with-new.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
