Actors Insights|Latest update04/07/2026

Infy Cluster

Suspected state sponsor: Islamic Republic of Iran

Infy is a long-running Iranian cyber espionage cluster first documented by Palo Alto Networks in 2016, with roots going back to at least 2007. The group is notable for a sustained, decade-long surveillance campaign primarily targeting Iranian dissidents, opposition members, and foreign government officials — particularly those linked to Iran policy. The cluster operates malware known as Infy (from which the group takes its name) and its successor Foudre, both designed for long-term covert surveillance.

 

Targets and Goals

Infy's primary targets are Iranian dissidents living abroad, members of the Iranian opposition, and individuals connected to governments engaged in Iran-related policy — including the United States and Israel. The group has also targeted Kurdish communities and ethnic minorities. This domestic-repression-oriented targeting profile, combined with the cluster's longevity, suggests close alignment with Iranian state security services rather than military intelligence.

 

Tooling and Tactics

Infy malware is a Windows-based spyware platform delivered via spear phishing emails with malicious attachments, often disguised as legitimate documents relevant to the target's background. The malware collects keystrokes, screenshots, audio recordings, and file system contents and transmits them to command and control servers. After Palo Alto's 2016 sinkholing operation disrupted the Infy infrastructure, the group returned with an evolved successor called Foudre — featuring improved encryption and anti-analysis capabilities — demonstrating operational resilience. The group later evolved into the Prince of Persia campaign tracking by Intezer, which documented continued activity through 2020 and beyond.

 

Aliases

The cluster is tracked under several campaign names: Infy (Palo Alto Networks), Foudre (the evolved malware family), Prince of Persia (Intezer), and Operation Mermaid (a related campaign name). All refer to the same long-running Iranian surveillance infrastructure.

Most Common Tactics

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
Jun 2016 ~ Jun 2016
Australia
AU
Australia
Australia
Jun 2016 ~ Jun 2016
Austria
AT
Austria
Austria
Jun 2016 ~ Jun 2016
Azerbaijan
AZ
Azerbaijan
Azerbaijan
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Bahrain
BH
Bahrain
Bahrain
Jun 2016 ~ Jun 2016
Belgium
BE
Belgium
Belgium
Jun 2016 ~ Jun 2016
Canada
CA
Canada
Canada
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
China
CN
China
China
Jun 2016 ~ Jun 2016
Denmark
DK
Denmark
Denmark
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
Apr 2010 ~ Mar 2020
May 2015 ~ May 2016
Apr 2010 ~ Mar 2020
May 2015 ~ May 2016
Apr 2010 ~ Mar 2020
Feb 2017 ~ Feb 2021
Apr 2010 ~ Mar 2020
Feb 2017 ~ Feb 2021
Apr 2010 ~ Mar 2020
Feb 2017 ~ Feb 2021
Apr 2010 ~ Mar 2020
Feb 2017 ~ Feb 2021
Apr 2010 ~ Mar 2020
Feb 2017 ~ Feb 2021
Apr 2010 ~ Mar 2020
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Europe
EU
Europe
Europe
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Finland
FI
Finland
Finland
Jun 2016 ~ Jun 2016
France
FR
France
France
Jun 2016 ~ Jun 2016
Germany
DE
Germany
Germany
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
India
IN
India
India
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Indonesia
ID
Indonesia
Indonesia
Jun 2016 ~ Jun 2016
Iran
IR
Iran
Iran
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Nov 2017 ~ Aug 2018
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Nov 2017 ~ Aug 2018
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Iraq
IQ
Iraq
Iraq
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Ireland
IE
Ireland
Ireland
Jun 2016 ~ Jun 2016
Israel
IL
Israel
Israel
May 2015 ~ May 2016
May 2015 ~ May 2016
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Italy
IT
Italy
Italy
Jun 2016 ~ Jun 2016
Jordan
JO
Jordan
Jordan
Jun 2016 ~ Jun 2016
Lebanon
LB
Lebanon
Lebanon
Jun 2016 ~ Jun 2016
Malaysia
MY
Malaysia
Malaysia
Jun 2016 ~ Jun 2016
Netherlands
NL
Netherlands
Netherlands
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Norway
NO
Norway
Norway
Jun 2016 ~ Jun 2016
Pakistan
PK
Pakistan
Pakistan
Jun 2016 ~ Jun 2016
Qatar
QA
Qatar
Qatar
Jun 2016 ~ Jun 2016
Romania
RO
Romania
Romania
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Russia
RU
Russia
Russia
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jun 2016 ~ Jun 2016
Seychelles
SC
Seychelles
Seychelles
Feb 2017 ~ Aug 2017
Feb 2017 ~ Aug 2017
Sweden
SE
Sweden
Sweden
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Switzerland
CH
Switzerland
Switzerland
Jun 2016 ~ Jun 2016
Syria
SY
Syria
Syria
Jun 2016 ~ Jun 2016
Tajikistan
TJ
Tajikistan
Tajikistan
Jun 2016 ~ Jun 2016
Turkey
TR
Turkey
Turkey
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jun 2016 ~ Jun 2016
United Kingdom
GB
United Kingdom
United Kingdom
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
Feb 2017 ~ Feb 2021
United States
US
United States
United States
May 2015 ~ May 2016
May 2016 ~ Dec 2025
May 2015 ~ May 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
Jun 2016 ~ Jun 2016
May 2016 ~ Dec 2025
Feb 2017 ~ Aug 2017
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
Feb 2017 ~ Feb 2021
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
May 2016 ~ Dec 2025
Jan 2010Apr 2026

Recent Activities

  1. Public
    Prince of Persia APT Expands Long-Running Iranian Cyber Espionage Operations
  2. Public
    Infy Group's Evolving Cyber Tactics: Unveiling Foudre and Tonnerre Malware
  3. Public
    Decade-Old Foudre APT Adopts “Tonnerre” for Sophisticated Cyber Espionage Activities
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.