The Evolution of Infy: Cyber Espionage Campaigns Against Western Entities

Cybersecurity researchers have uncovered evidence of renewed activity from a long-running cyber operation known as "Infy" or "Prince of Persia". After a significant period of downtime following a 2016 takedown, the attackers have regrouped and dramatically improved their technical capabilities. They are now deploying a highly stealthy, previously unknown malware component designed to monitor victims and steal data.

The attacks are attributed to an Advanced Persistent Threat group backed by the government of the Islamic Republic of Iran. This operation has been active since at least 2007. The attackers have previously demonstrated unique, government-level capabilities, such as relying on the Telecommunication Company of Iran to block and redirect network traffic to regain control of their compromised victims.

The campaign is a sophisticated cyber espionage operation designed to stealthily monitor targets and extract sensitive information. Researchers believe the attackers are not financially motivated; instead, their primary goal is intelligence gathering. The newly discovered tools allow the attackers to silently steal documents, capture computer screens, and record audio from the victim's surroundings.

Historically, the operation heavily targeted victims within Iran and throughout Europe. In the most recent wave of activity, researchers identified new victims in Turkey, including a university and a state-owned investment bank. Curiously, researchers noted a glaring absence of Iranian victims in the most recent probing data, suggesting the attackers may have proactively altered their targeting or infrastructure strategies.

In the past, the campaign targeted Iranian dissidents, civil society members, the Persian press (such as BBC Persian), US Government entities, and Israeli companies. Recent attacks used decoy documents referencing an Iranian governor and a government-sponsored foundation that provides loans to veterans. This indicates a continued focus on individuals connected to regional politics, diplomacy, and state affairs.

The attackers trick victims by sending them documents that appear legitimate, such as official letters or loan forms. When the victim closes the document, a hidden script automatically runs and installs an initial foothold on the computer. This initial program securely connects to the attacker's servers to download a massive, camouflaged secondary tool that carries out the actual data theft and surveillance.

The targeted entities, which include foreign state-owned banks, universities, diplomats, and dissidents, possess highly sensitive information. Access to these individuals and organizations provides the Iranian government with valuable political intelligence, insight into opposition movements, and access to diplomatic or regional communications.

Organizations must ensure their security software does not skip scanning exceptionally large files, as these attackers intentionally use massive files to bypass basic security checks. Furthermore, users should be highly suspicious of unexpected documents and ensure that automatic macros are disabled in their document viewers, as this is the primary trick used to break into computers.