# Infy: threat group profile

> Infy is an espionage group thought to operate from Iran, with suspected state backing. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.precursorintelligence.com/threat-actors/infy
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > Infy

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 15 |
| Thought to operate from | Iran |
| Suspected backing | Iran |
| Motive | Espionage |
| Other names | 3 |
| Public reports | 10 |

## Who is Infy?

Infy is an espionage group thought to operate from Iran, with suspected state backing. Public reporting about it is still limited.

### Also known as

Operation Mermaid, Prince of Persia, Foudre

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Infy is a group of suspected Iranian origin. Since early 2013, we have observed activity from a unique threat actor group, which we began to investigate based on increased activities against human right activists in the beginning of 2015. In line5with other research on the campaign, released prior to publication of this document, we have adopted the name “Infy”, which is based on labels used in the infrastructure and its two families of malware agents. Thanks to information we have been able to collect during the course of our research, such as characteristics of the group’s malware and development cycle, our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state. Amongst a backdrop of other incidents, Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014, growing in use up to the February 2016 parliamentary election in Iran. After the conclusion of the parliamentary election, the rate of attempted intrusions and new compromises through the Infy agent slowed, but did not end. The trends witnessed in reports from recipients are reinforced through telemetry provided by design failures in more recent versions of the Infy malware.

## Who does Infy go after?

**Sectors:** Government, Private sector

**Countries and victims named:** Israel, Iran, France, China, Sweden, United States, United Kingdom, Germany, Syria, Italy, Denmark, Canada, Russia, Saudi Arabia, Bahrain

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about Infy

- https://www.intezer.com/prince-of-persia-the-sands-of-foudre/
- https://www.freebuf.com/articles/network/105726.html
- https://www.blackhat.com/docs/us-16/materials/us-16-Guarnieri-Iran-And-The-Soft-War-For-Internet-Dominance-wp.pdf
- https://iranthreats.github.io/
- http://researchcenter.paloaltonetworks.com/2016/05/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/
- http://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/
- https://researchcenter.paloaltonetworks.com/2017/08/unit42-prince-persia-ride-lightning-infy-returns-foudre/
- https://www.cfr.org/interactive/cyber-operations/prince-persia
- https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/
- https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/

## Frequently asked questions

### Who is Infy?

Infy is an espionage group thought to operate from Iran, with suspected state backing. Public reporting about it is still limited.

### Where is Infy thought to be based?

Public reporting places Infy as operating from Iran, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Infy target?

In public reporting, sectors named include government and private sector, and 15 countries and victims are named, including Israel, Iran, France and China.

### How do I know if Infy is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact