Prince of Persia APT Analysis: Infy, Foudre, and Tonnerre Malware

Prince of Persia (also tracked as APT-C-07) is a long-running Iran-aligned cyber-espionage actor assessed to be active since 2007. The group has cycled through multiple proprietary malware families—Infy, Foudre, Tonnerre, and MaxPinner—to surveil media organizations, political entities, and civil-society targets. Operations commonly blend spear-phishing with opportunistic drive-by infection paths and rely on bespoke command-and-control methods, including Telegram bot–based channels, to sustain access and move data off compromised systems.

Unit 42 and other research teams traced the actor’s tooling progression from Infy infrastructure observed in 2016 to the return of Foudre activity in 2017 and a 2025 iteration of Tonnerre that uses Telegram for command-and-control. Technical reporting highlights delivery through Visual Basic macro droppers, persistence via Windows service installation, and the use of domain-generation logic to support resilient infrastructure. Analysts also documented native Windows API–level functionality used for credential access and surveillance behaviors such as keylogging, alongside execution patterns that indicate ongoing refinement of post-compromise tradecraft.

Apply strict controls for Office macros and enforce email attachment sanitization to reduce initial execution opportunities. Implement network controls to restrict or closely monitor Telegram traffic in environments where it is not required for business operations. On endpoints, alert on suspicious service creation, track rundll32 usage consistent with DLL execution chains, and block known malicious filenames and registry-based persistence patterns. Maintain updated detection content for dynamically changing domain patterns associated with DGA-like behavior and routinely validate controls against current telemetry.

If indicators are detected, isolate the affected system, capture volatile artifacts, and hunt for the specific service names and registry entries used for persistence. Expand triage to scheduled task creation, anomalous DLL load activity, and any evidence of Telegram-based C2 communications. Remove malicious services and staged files using vetted remediation playbooks, then rotate potentially exposed credentials and monitor closely for re-entry attempts or re-infection across adjacent hosts.

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands: The simulated adversary mimics Infy malware behavior by creating three dummy executables whose filenames correspond to the API calls the rule watches. Using Copy-Item , we duplicate notepad.exe (a benign, already‑present binary) to the temporary directory and rename it to match each API call. The attacker then executes each dummy binary, producing Sysmon process‑creation events with Image values ending in GetFileAttributesA.exe , GetMessageA.exe , and DispatchMessageA.exe . Because the rule’s condition is selection1 or selection2 on the Image field, each launch satisfies the rule and generates an alert.

Regression Test Script:

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.