MaxPinner Malware — Analysis, Campaigns & Threat Activity

Overview

MaxPinner is a malware family linked to the Iranian Prince of Persia (PoP) APT in recent threat reporting. The coverage indicates PoP is expanding its toolkit with multiple variants—Infy, Foudre, and Tonnerre—and introducing a revamped C2 infrastructure, signaling renewed capability and ongoing espionage activity.

Related Threat Clusters

• Iranian APT 'Prince of Persia' Resurfaces with New Malware Variants

  The Iranian threat group known as Prince of Persia has re-emerged with three new malware strains targeting critical infrastructure globally. A December 2025 report from SafeBreach revealed that the group, which had been…

  2 articles · Updated December 31, 2025
• Iran-aligned APT-C-07 Uses Infy, Foudre, and Tonnerre Malware for Cyber Espionage

  The Prince of Persia APT, also known as APT-C-07, has been active since 2007 and is linked to Iranian cyber-espionage efforts. This group employs various malware families, including Infy, Foudre, and Tonnerre, to target…

  1 article · Updated January 16, 2026

Recent Intelligence Reports

• Prince of Persia APT Analysis: Infy, Foudre, and Tonnerre Malware — Socprime · January 16, 2026
• Iranian APT Prince of Persia returns with new malware and C2 infrastructure — Csoonline · December 19, 2025

Related Entities