Iranian Infy APT Resurfaces with New Malware Activity After Years of Silence

Threat researchers have traced renewed activity linked to the Iranian threat actor Infy (aka Prince of Persia), nearly five years after its earlier campaigns in Sweden, the Netherlands, and Turkey. According to SafeBreach, the covert operation has targeted Iran, Iraq, Turkey, India, Canada, and European victims using updated versions of Foudre (version 34) and Tonnerre (versions 12–18, 50), with Tonnerre’s latest iteration detected in September 2025.

The operation’s C2 infrastructure employs a domain generation algorithm (DGA) and artifacts show a mechanism where Foudre and Tonnerre validate C2 domains by downloading an RSA-signed file, decrypting it with a embedded public key. SafeBreach notes a shift in attack chains from macro‑laden Excel files to embedding executables in documents to install Foudre, and highlights a directory named “key” on the C2 server used for validation logs and exfiltrated data.

The latest Tonnerre variant also communicates with a Telegram group named “سرافراز,” via a Telegram bot and a user, with access restricted to specific victim GUIDs, reflecting a continued, evolving modus operandi.