Decade-Long Prince of Persia Cyber Campaign Targets Iranian Citizens and Global Victims

Cybersecurity researchers successfully disrupted a ten-year-long cyberespionage campaign. By taking control of the servers the attackers used to communicate with infected computers, researchers permanently disabled the attackers' ability to access their victims or steal further data.

The report does not explicitly name a specific group or country behind the operation. However, the operators demonstrated high levels of dedication, running a coordinated espionage campaign for a full decade and actively updating their malicious tools to maintain secret access.

The primary goal of this campaign was intelligence gathering and data theft. The malicious software was designed to secretly monitor computers, log keystrokes, and steal a massive variety of private files, documents, databases, and media.

The campaign had a relatively low number of victims, pointing to a highly focused and deliberate effort rather than a mass-infection approach. Researchers identified 326 compromised computer systems spread across 35 different countries.

The campaign primarily targeted government and industry interests worldwide, with a very heavy emphasis on Iranian citizens, who made up nearly a third of all victims. The attackers also deployed much more sophisticated software against specific individuals they deemed to be high-value targets.

Attackers infected computers with a hidden program called "Infy," which quietly mapped out the system, recorded user activity, and hunted for valuable files. This stolen data was then locked up with a custom code and secretly transmitted back to servers controlled by the espionage group.

Government and industry personnel frequently have access to sensitive intellectual property, state secrets, or confidential internal communications. Additionally, the targeted citizens likely possessed valuable personal information or communications of direct interest to the espionage operators.

Organizations must ensure their anti-virus and security software are active and up to date, as the newest versions of this malware actively searched for ways to bypass common security tools. Maintaining strong network monitoring can also help catch unauthorized attempts to send stolen data out of the network.