Dormant Iran APT is Still Alive, Spying on Dissidents

Dormant Iran APT Prince of Persia, also known as Infy, has re-emerged, with SafeBreach reporting that the group has been active throughout the past decade while spying on Iranian citizens and individuals in Iraq, Turkey, India, Europe, and Canada. Described as one of the oldest APTs, its activity previously faded from public view, but researchers say it has maintained an operational cyberattack infrastructure for nearly 20 years, enabling ongoing espionage.

The operation relies on two primary tools, Foudre and Tonnerre; Foudre now arrives disguised inside a Microsoft Excel file and can exfiltrate basic system information before optionally destructing, while Tonnerre is used for more involved campaigns and even leverages the Telegram API for C2 communications. Foudre’s defence includes RSA signature verification and a domain generation algorithm that creates 100 potential C2 domains weekly, with the first used only if the signature validates.

The report notes the group’s sophisticated persistence, and that its existence was first highlighted by Palo Alto Networks’ Unit 42, which sinkholed its servers in 2016 before Iran’s Telecommunication Company redirected traffic to benefit the attackers. According to Unit 42, the threat actor later rebuilt a highly secure architecture that has remained resilient to takedowns since 2017.