Decade-Long Infy Malware Campaign Targets Israeli Industry and U.S. Government

Cybersecurity researchers uncovered a hidden cyber espionage operation that has been active for nearly a decade. Attackers used malicious emails to quietly install a family of malware, known as "Infy," onto victims' computers to steal sensitive data, passwords, and documents.

Evidence strongly suggests the campaign is a targeted espionage operation originating from Iran. Analysts traced the attack infrastructure to Iranian hosting services and found domain registration details linked to individuals with Iranian origins.

The operation was focused on long-term data theft and intelligence gathering. The attackers sought to quietly steal documents, passwords, system information, and even audio recordings while taking extreme care to remain undetected by security software.

Yes, the attackers targeted high-value entities, including the U.S. Government, the Danish Government, and Israeli industrial organizations. The threat actors also targeted their own Iranian citizens.

Attackers sent tailored spear-phishing emails containing malicious Word or PowerPoint documents. When opened, these files tricked the victim into clicking a button—such as a fake "play" button on a video, which secretly installed the Infy malware onto their system.

Government and industrial organizations hold highly sensitive intellectual property, state secrets, and operational data. Access to these systems provides significant strategic and intelligence value to a nation-state actor.

This is a highly targeted, low-volume operation. The attackers deliberately kept the number of attacks small and customized their deceptive content for specific victims to avoid drawing the attention of global security companies.