Loading story…
The Iranian state-sponsored threat group known as "Prince of Persia" or "Infy" has resurfaced after years of apparent dormancy, with new research revealing that the group has maintained continuous operations targeting dissidents and organizations both within Iran and internationally. Recent findings indicate that the group has upgraded its operational security, cryptographic communications, and malware arsenal, enabling it to persist undetected for nearly two decades. Victims have included Iranian citizens, as well as individuals and organizations in Iraq, Turkey, India, Europe, and Canada, with the group leveraging advanced variants of its established malware families such as Foudre and Tonnerre.
SafeBreach researchers have provided detailed technical analysis of the group's latest campaigns, identifying new malware versions and outlining indicators of compromise (IoCs) to aid defenders. The group's ability to remain active and effective for such an extended period is attributed to its sophisticated operational security measures and continuous evolution of its tools and techniques. This resurgence underscores the persistent threat posed by Iranian APTs to both regional dissidents and global critical infrastructure, highlighting the need for ongoing vigilance and updated defensive strategies.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
On December 18, 2025, SafeBreach published research concluding that Prince of Persia remains active and has significantly evolved despite years of low visibility. The report detailed updated malware, infrastructure, attribution evidence, and indicators of compromise for defenders and law enforcement.
The group introduced stronger operational security, including Telegram-based command-and-control for some victims, frequent C2 rotation, and a domain generation algorithm protected by RSA-based validation. These changes made sinkholing and infrastructure impersonation more difficult for defenders.
During its renewed activity, Prince of Persia deployed updated Foudre and Tonnerre variants, shifted from macro-based Excel lures to Excel files with embedded executables, and used additional malware families and trojanized binaries. The changes improved evasion and helped maintain persistence on selected victims.
SafeBreach observed multiple new Prince of Persia campaigns over the past three years, showing the group had resumed significant cyber-espionage activity after an apparent lull. These operations targeted victims in Iran as well as Iraq, Turkey, India, Europe, and Canada.
SafeBreach researchers said they accessed stolen data because of a flaw in the attackers' file-naming convention, revealing victim data dating from 2021 onward. This indicates the group remained active during a period when public reporting was limited.
In 2016, Palo Alto Networks Unit 42 attempted to disrupt Prince of Persia operations. Dark Reading reports that Iran's state-owned Telecommunication Company of Iran allegedly helped the actor recover by blocking and redirecting traffic away from Unit 42 sinkholes.
SafeBreach and follow-on reporting describe the Iran-linked Prince of Persia (also known as Infy) espionage group as active since at least 2007. The group began a long-running campaign targeting dissidents, civil society, and other organizations, primarily tied to Iranian interests.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecsoonline.com
Open sourcedarkreading.com
Open sourcehackread.com
Open sourcesafebreach.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026
Researchers reported that the Iranian-attributed **Infy** group, also known as **Prince of Persia**, resumed cyber-espionage operations with updated **Foudre** malware and a more capable second-stage backdoor called **Tonnerre**. The campaign used Persian-language lure documents and malicious archives containing a macro-enabled Word file and a disguised executable to infect Windows `x86` and `x64` systems, with **Foudre v23** serving as the initial foothold before downloading or installing Tonnerre on selected higher-value targets. The activity followed earlier disruption efforts but showed the group had rebuilt its tooling and infrastructure. **Tonnerre** expanded the operation beyond basic compromise by adding persistence, file theft, screenshot capture, optional microphone recording, remote command execution, and exfiltration over **HTTP** and **FTP**, while researchers also observed RSA-based server authentication, anti-analysis checks, and evolving **DGA-based** command-and-control infrastructure. Bitdefender said it sinkholed one Tonnerre domain and saw traffic from dozens of apparent victim IPs, indicating the campaign was still active, while Check Point and SafeBreach linked victim activity outside Iran, including organizations in **Turkey** such as a university and a state-owned investment bank. Earlier reporting from Unit 42 tied Infy to a decade of targeted attacks and documented the group’s transition from older Infy malware to **Foudre**, underscoring the continuity of the espionage operation.
Sep 4, 2026
Iranian state-sponsored threat actors have intensified their cyber operations, targeting government officials, defense sector personnel, and dissidents through sophisticated espionage and disruptive campaigns. The APT42 group, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), has launched the 'SpearSpecter' campaign, employing highly personalized social engineering tactics to compromise senior defense and government officials, as well as their family members. These operations involve building trust over extended periods and leveraging fake conference invitations or meetings to deliver malicious payloads. Other Iranian-linked groups, such as Ferocious Kitten, have focused on targeting dissidents and activists with spear-phishing attacks that deploy custom malware like MarkiRAT, which features advanced data exfiltration and persistence techniques. In parallel, the DEV-1084 group, operating under the 'DarkBit' persona and closely associated with the Iranian state-linked MERCURY group, has conducted ransomware campaigns that prioritize destruction over financial gain. These attacks combine on-premises encryption with the mass deletion of cloud resources, effectively wiping out victim environments and aligning with broader strategic objectives of disruption and psychological impact. Technical analysis has revealed shared infrastructure and tools between DEV-1084 and MERCURY, further solidifying the connection to Iran’s Ministry of Intelligence and Security (MOIS). These coordinated campaigns underscore the evolving threat landscape posed by Iranian APTs, which blend espionage, destructive attacks, and advanced social engineering to achieve their objectives.
Jul 12, 2026