Loading malware…
Tornado is a Windows backdoor used by the Iranian state-sponsored espionage actor Prince of Persia, also known as Infy. It forms part of the actor’s multistage malware ecosystem alongside Foudre and Tonnerre. Initially identified as Tonnerre version 50, Tornado incorporates Foudre-derived code, with version 51 supporting command-and-control communications over HTTP/HTTPS and the Telegram API. Prince of Persia targets Iranian dissidents and public- and private-sector organizations in the United States, Europe, and the Middle East.
Tornado receives commands and exfiltrates stolen files through Telegram bots and attacker-controlled infrastructure. It retrieves Telegram configuration from backend servers rather than embedding the configuration directly in its code. Its infrastructure-discovery mechanisms include a domain generation algorithm and decoding domain information from blockchain transaction data. RSA-based authentication helps prevent unauthorized access to its command-and-control infrastructure and complicates sinkholing. Its use of legitimate web services helps conceal malicious communications within ordinary network traffic.
Observed delivery exploits recently disclosed WinRAR vulnerabilities to place Tornado in the Windows Startup folder. Persistence mechanisms also include scheduled tasks, and the malware checks for Avast antivirus.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
"...establishes persistence through scheduled tasks..."
"The malware, delivered via a self-extracting archive..."
"...establishes persistence through scheduled tasks..."
"...establishes persistence through scheduled tasks..."
“The threat actor is using a 1-day WinRAR vulnerability… to extract Tornado to the startup folder.”
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.