InfyThreat actor
- foudre
- operation mermaid
- Prince of Persia
Infy is a group of suspected Iranian origin. Since early 2013, we have observed activity from a unique threat actor group, which we began to investigate based on increased activities against human right activists in the beginning of 2015.From MISP Galaxy
Last reported yesterday, by SecurityWeek5 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1552.004Private Keys
“Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys”
- T1110.003Password Spraying
“Tracked as Storm-0940 and active since at least 2021, the APT is known for relying on password spraying and the exploitation of vulnerable internet-facing applications to hack into organizations across multiple sectors.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1542.003Bootkit
“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
- T1684Social Engineering
“Phantom Deal profile: Gen Digital has stumbled upon a cybercrime group that poses as executives who use WhatsApp social-engineering to trick victims into investing or acquiring fake companies.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks“Related: Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016”
-
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016“Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“Prince of Persia: Semperis says the Iranian APT group Prince of Persia has switched from hosting C&C servers in Europe to the US.”
-
Iranian Hacking Group Found Hosting C2 Infrastructure in the US“The Iranian group is known as ‘Prince of Persia’, which has been active for around two decades.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“New Prince of Persia infrastructure: Whisper security researchers have spotted new backend infra and domains linked to Prince of Persia (Infy) APT operations.”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- idscan[.]netin 1 report
- pylos[.]coin 1 report
- crypto[.]newsin 1 report
- infosec[.]exchangein 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.