Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Prince of Persia – Ride the Lightning: Infy returns as “Foudre”

Summary: Unit 42 Palo Alto Networks reported in February 2017 that the decade-old Infy information stealer had returned in a new version called "Foudre," adding a Domain Generation Algorithm for C2 domains and an RSA signature check to prevent the sinkholing Palo Alto used against its C2 servers in 2016. Foudre keeps the original Delphi code and Infy behavior - keylogging, clipboard capture every ten seconds, system and browser data collection, and HTTP POST exfiltration - and spreads via spear-phishing emails with self-executing attachments.

What's compelling: Palo Alto forecast and registered one of the DGA domains before the adversary, but without the RSA private key it could not verify the domain to victims, so the takedown playbook that worked in 2016 no longer closes the campaign. The victim spread remains predominantly Iranian-domestic with a small number of targets, which the researchers read as a non-financial motive.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related