Infy Returns: Iran-linked hacking group shows renewed activity

According to SafeBreach, renewed activity by the Iran-linked APT group Infy, also known as Prince of Persia, shows the threat actor remains active and potentially larger in scale than previously believed. Researchers note that Infy has been active since at least 2004, with a history of long-running espionage campaigns targeting governments and organisations.

The report highlights ongoing development of its Foudre and Tonnerre malware families, including Tonnerre variants run in parallel and a new v50 seen in September 2025 featuring a previously unknown DGA. It also points to a shift in command‑and‑control infrastructure, with Tonnerre v50 redirecting victims to a Telegram group and bot, likely replacing older FTP‑based data exfiltration.

The analysis emphasises that new infection vectors and updated C2 structures, alongside continued use of Telegram for command and data exfiltration, reinforce attribution to an Iran‑linked threat group active since at least 2017. Overall, the findings describe a persistent, highly organised espionage operation with continuous innovation, even after periods of dormancy.