Mermaid

Operation Mermaid is a campaign designation for a subset of Infy cluster activity targeting Iranian opposition members and dissidents, documented through 2020. The operation used the Infy and Foudre malware families delivered via spear phishing to conduct long-term surveillance of targets including Kurdish communities and Iranian ethnic minorities. Operation Mermaid activity overlaps with the broader Prince of Persia campaign tracking by Intezer and shares the same Iranian state surveillance mission and technical infrastructure as the core Infy cluster.