Iran-aligned APT-C-07 Uses Infy, Foudre, and Tonnerre Malware for Cyber Espionage

Socprime

Iran-aligned APT-C-07 Uses Infy, Foudre, and Tonnerre Malware for Cyber Espionage

First seen 17 Jan 2026, 05:01 UTC • •53.9

Article Content

1 / 2

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The Prince of Persia APT, also known as APT-C-07, has been active since 2007 and is linked to Iranian cyber-espionage efforts. This group employs various malware families, including Infy, Foudre, and Tonnerre, to target media organizations, political entities, and civil society. Their operations typically involve spear-phishing and drive-by infection techniques, utilizing unique command-and-control methods like Telegram bot channels.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

More articles in this cluster (1)

Threat Graph

11 entities, 20 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Apt-c-07
Prince Of Persia
Infy

Technique (3)

Malware
Phishing
T1566 - Spearphishing

Malware (3)

Foudre
MaxPinner
Tonnerre

Affected Platform (2)

Windows
Telegram

Relationships

Apt-c-07 uses Foudre
Apt-c-07 uses MaxPinner
Apt-c-07 uses Tonnerre
Prince Of Persia uses Foudre
Prince Of Persia uses MaxPinner
Prince Of Persia uses Tonnerre
Infy uses Foudre
Infy uses MaxPinner
Infy uses Tonnerre
Apt-c-07 uses Malware
Apt-c-07 uses Phishing
Apt-c-07 uses T1566 - Spearphishing
Prince Of Persia uses Malware
Prince Of Persia uses Phishing
Prince Of Persia uses T1566 - Spearphishing
Infy uses Malware
Infy uses Phishing
Infy uses T1566 - Spearphishing
Apt-c-07 related to Windows
Apt-c-07 related to Telegram

Following this threat?

Track Apt-c-07 and Foudre in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…