🇮🇷

Infy

APT Group Information theft and espionage 118 zero-day CVEs ETDA ✓

Also Known As 3 names

Foudre Operation Mermaid Prince of Persia

Target Countries 18

Countries highlighted in red

Azerbaijan Bahrain Canada China Germany Denmark France Israel India Iraq Islamic Republic of Iran Italy Netherlands Romania Saudi Arabia Sweden Turkey United States

Sectors Targeted

Government private sectors

Details

Origin 🇮🇷 IR

Last Updated 01 Jun 2022

Malware Families 1

tonnerre

MITRE ATT&CK 96

T1003 T1005 T1007 T1008 T1011 T1012 T1016 T1020 T1021 T1027 - Obfuscated Files or Information T1033 T1036 T1039 T1041 T1047 T1048 T1049 T1053 T1055 T1057 T1059 T1059.001 T1059.003 T1060 T1068 T1070 T1071 T1071.001 T1078 T1081 T1082 T1083 T1085 T1087 T1090 T1095 T1100 T1102 T1105 T1106 T1110 T1112 T1114 T1114.001 T1115 T1119 T1120 T1124 T1127 T1130 T1132 T1133 T1136 T1137 T1140 T1170 T1176 T1190 T1199 T1204 - User Execution T1204.002 T1213 T1217 T1218 T1485 T1486 T1489 T1490 T1497 T1497.003 T1498.001 T1499 T1499.001 T1503 T1518 T1529 T1530 T1531 T1539 T1543 T1547 T1550 T1552 T1553 T1555 T1560 T1561 T1562 T1562.001 T1566 - Phishing T1570 T1571 T1573 T1583 T1587 T1595

Related Zero-Days 118

CVE-2017-0143 CVE-2017-0144 CVE-2017-3881 CVE-2017-5638 CVE-2018-0802 CVE-2018-8174 CVE-2019-0708 CVE-2019-3568 CVE-2020-1472 CVE-2020-6418 CVE-2021-21166 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2021-33742 CVE-2021-40449 CVE-2021-44228 CVE-2022-0609 CVE-2022-22965 CVE-2022-26134 CVE-2022-30190 CVE-2022-3236 CVE-2022-41040 CVE-2022-41082 CVE-2022-41128 CVE-2022-42475 CVE-2023-0669 CVE-2023-20198 CVE-2023-2033 CVE-2023-2136 CVE-2023-23397 CVE-2023-2868 CVE-2023-3079 CVE-2023-34048 CVE-2023-36884 CVE-2023-38831 CVE-2023-41991 CVE-2023-41992 CVE-2023-41993 CVE-2023-46805 CVE-2023-4762 CVE-2023-4966 CVE-2024-0012 CVE-2024-1086 CVE-2024-12356 CVE-2024-20399 CVE-2024-21412 CVE-2024-21887 CVE-2024-21893 CVE-2024-24919 CVE-2024-3400 CVE-2024-38080 CVE-2024-38112 CVE-2024-38178 CVE-2024-38193 CVE-2024-4610 CVE-2024-47575 CVE-2024-4947 CVE-2024-50302 CVE-2024-50623 CVE-2024-53104 CVE-2024-53197 CVE-2024-55591 CVE-2024-8190 CVE-2024-8963 CVE-2024-9379 CVE-2024-9380 CVE-2024-9474 CVE-2025-0282 CVE-2025-0283 CVE-2025-0411 CVE-2025-10035 CVE-2025-1316 CVE-2025-20333 CVE-2025-20352 CVE-2025-21043 CVE-2025-21391 CVE-2025-21418 CVE-2025-22224 CVE-2025-22225 CVE-2025-22226 CVE-2025-22457 CVE-2025-24085 CVE-2025-24201 CVE-2025-26633 CVE-2025-2783 CVE-2025-29824 CVE-2025-30066 CVE-2025-31200 CVE-2025-31201 CVE-2025-38352 CVE-2025-41244 CVE-2025-43200 CVE-2025-43300 CVE-2025-4427 CVE-2025-4428 CVE-2025-48543 CVE-2025-49704 CVE-2025-53770 CVE-2025-53771 CVE-2025-54309 CVE-2025-54948 CVE-2025-54987 CVE-2025-55177 CVE-2025-55182 CVE-2025-58360 CVE-2025-59230 CVE-2025-59287 CVE-2025-61882 CVE-2025-61932 CVE-2025-6218 CVE-2025-6554 CVE-2025-6558 CVE-2025-7775 CVE-2025-8088 CVE-2025-9242 CVE-2025-9491

Known Names 4 entries

Infy Palo Alto

Prince of Persia Palo Alto

Operation Mermaid Qihoo 360

APT-C-07 Qihoo 360

Observed Target Countries 21

Based on ETDA data — countries highlighted in red

Azerbaijan Bahrain Canada China Denmark France Germany India Iran Iraq Israel Italy Romania Netherlands Russia Saudi Arabia Sweden Syria Turkey UK USA

Description

Since early 2013, we have observed activity from a unique threat actor group, which we began to investigate based on increased activities against human right activists in the beginning of 2015. In line5with other research on the campaign, released prior to publication of this document, we have adopted the name “Infy”, which is based on labels used in the infrastructure and its two families of malware agents. Thanks to information we have been able to collect during the course of our research, such as characteristics of the group’s malware and development cycle, our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state. Amongst a backdrop of other incidents, Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014, growing in use up to the February 2016 parliamentary election in Iran. After the conclusion of the parliamentary election, the rate of attempted intrusions and new compromises through the Infy agent slowed, but did not end. The trends witnessed in reports from recipients are reinforced through telemetry provided by design failures in more recent versions of the Infy malware.

Tools Used 2

Infy Tonnerre

Operations 2

2015-05 In May 2015, Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account, sent to an Israeli industrial organization. One e-mail carried a Microsoft PowerPoint file named “thanks.pps”, the other a Microsoft Word document named “request.docx”. https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/

2017-02 In February 2017, we observed an evolution of the “Infy” malware that we’re calling “Foudre” (“lightning”, in French). The actors appear to have learned from our previous takedown and sinkholing of their Command and Control (C2) infrastructure – Foudre incorporates new anti-takeover techniques in an attempt to avoid their C2 domains being sinkholed as we did in 2016. https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/

Reports & References 1

https://www.blackhat.com/docs/us-16/materials/us-16-Guarnieri-Iran-And-The-Soft-War-For-Internet-Dominance-wp.pdf

ETDA Profile

Infy, Prince of Persia

Origin

Iran

First Seen 2007

Sponsor State-sponsored

Motivation

Information theft and espionage

View on ETDA APT Groups ↗