Prince of Persia APT Analysis: Infy, Foudre, and Tonnerre Malware

Summary

Prince of Persia (also tracked as APT-C-07) is a long-running Iran-aligned cyber-espionage actor assessed to be active since 2007. The group has cycled through multiple proprietary malware families—Infy, Foudre, Tonnerre, and MaxPinner—to surveil media organizations, political entities, and civil-society targets. Operations commonly blend spear-phishing with opportunistic drive-by infection paths and rely on bespoke command-and-control methods, including Telegram bot–based channels, to sustain access and move data off compromised systems.

Investigation

Unit 42 and other research teams traced the actor’s tooling progression from Infy infrastructure observed in 2016 to the return of Foudre activity in 2017 and a 2025 iteration of Tonnerre that uses Telegram for command-and-control. Technical reporting highlights delivery through Visual Basic macro droppers, persistence via Windows service installation, and the use of domain-generation logic to support resilient infrastructure. Analysts also documented native Windows API–level functionality used for credential access and surveillance behaviors such as keylogging, alongside execution patterns that indicate ongoing refinement of post-compromise tradecraft.

Mitigation

Apply strict controls for Office macros and enforce email attachment sanitization to reduce initial execution opportunities. Implement network controls to restrict or closely monitor Telegram traffic in environments where it is not required for business operations. On endpoints, alert on suspicious service creation, track rundll32 usage consistent with DLL execution chains, and block known malicious filenames and registry-based persistence patterns. Maintain updated detection content for dynamically changing domain patterns associated with DGA-like behavior and routinely validate controls against current telemetry.

Response

If indicators are detected, isolate the affected system, capture volatile artifacts, and hunt for the specific service names and registry entries used for persistence. Expand triage to scheduled task creation, anomalous DLL load activity, and any evidence of Telegram-based C2 communications. Remove malicious services and staged files using vetted remediation playbooks, then rotate potentially exposed credentials and monitor closely for re-entry attempts or re-infection across adjacent hosts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The simulated adversary mimics Infy malware behavior by creating three dummy executables whose filenames correspond to the API calls the rule watches. Using Copy-Item, we duplicate notepad.exe (a benign, already‑present binary) to the temporary directory and rename it to match each API call. The attacker then executes each dummy binary, producing Sysmon process‑creation events with Image values ending in GetFileAttributesA.exe, GetMessageA.exe, and DispatchMessageA.exe. Because the rule’s condition is selection1 or selection2 on the Image field, each launch satisfies the rule and generates an alert.

• Regression Test Script:

  # -------------------------------------------------
  # Simulation Script – Infy API Call Detection Test
  # -------------------------------------------------
  $tempDir = "$env:TEMPInfySim"
  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
  
  # Helper: copy notepad.exe to a new name
  function Copy-And-Run {
      param (
          [string]$newName
      )
      $src = "$env:SystemRootSystem32notepad.exe"
      $dst = Join-Path $tempDir $newName
      Copy-Item -Path $src -Destination $dst -Force
      Write-Host "Created $dst"
      Start-Process -FilePath $dst -WindowStyle Hidden
  }
  
  # Create and execute dummy binaries matching the API names
  Copy-And-Run -newName "GetFileAttributesA.exe"
  Copy-And-Run -newName "GetMessageA.exe"
  Copy-And-Run -newName "DispatchMessageA.exe"
  
  Write-Host "Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # -------------------------------------------------
  # Cleanup Script – Remove simulated binaries
  # -------------------------------------------------
  $tempDir = "$env:TEMPInfySim"
  
  # Stop any remaining dummy processes
  Get-Process -Name "GetFileAttributesA","GetMessageA","DispatchMessageA" -ErrorAction SilentlyContinue |
      Stop-Process -Force
  
  # Remove the temporary directory and its contents
  Remove-Item -Path $tempDir -Recurse -Force -ErrorAction SilentlyContinue
  
  Write-Host "Cleanup complete."