Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Prince of Persia – Game Over

Summary: Unit 42 took control of all but one of the command-and-control domains used by the Infy malware family, a campaign it had documented as running for a decade against government and industry targets, and later had the remaining domains null-routed and a directly-IP-addressed server disabled with law enforcement. Analysis of victim traffic identified 456 malware agents on 326 victim systems across 35 countries, with nearly one-third of victims in Iran, and the attackers deployed a new Infy version 31 against a single Canadian target while keeping the same encoding key used throughout the campaign.

Bottom line: The attackers kept the identical encoding key for ten years and shipped a new version within a week of the report, which Unit 42 read as a sign they never saw the disclosure - a reminder that long-running intrusions can persist on victim systems well past the point where defenders assume they have been noticed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related