Loading malware…
Amaq News Finder is an Infy (also known as Prince of Persia) malware variant observed in campaigns attributed to the Iran-linked espionage group. It appears in older Infy operations alongside MaxPinner, Deep Freeze, and Rugissement, reflecting a long-running and adaptable toolset. Reporting states that a version of the Foudre downloader was camouflaged as Amaq News Finder to download and execute malware, and that Amaq News Finder variants were also found spying on victims’ Telegram accounts. The broader Infy activity is associated with phishing-based delivery, including malicious Excel documents and later documents with embedded executables, and has targeted victims primarily in Iran as well as Iraq, Turkey, India, Canada, and Europe. High-confidence associations in the source material tie Amaq News Finder to Infy’s cyber espionage operations against governments, organizations, dissidents, journalists, diplomats, and other politically relevant targets. No specific standalone indicators of compromise for Amaq News Finder are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Amaq News Finder is an older malware tool used by the Infy (Prince of Persia) APT group as part of their espionage toolkit.
Malware used as a camouflage for Foudre, acting as a downloader and executor for the main payload.
Amaq News Finder is a malware variant used by the Prince of Persia (Infy) group to spy on victims’ Telegram accounts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.