Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Prince of Persia: Infy Malware Active In Decade of Targeted Attacks

Summary: Palo Alto Networks' Unit 42 documented a previously unpublished malware family it calls Infy, collecting over 40 variants used in attacks stretching back to 2007 and still active as of April 2016. The campaigns begin with spear-phishing e-mails carrying Word or PowerPoint documents that embed a multi-layer SFX archive, install a DLL that writes to the autorun key and waits for a reboot, then checks for antivirus, starts a keylogger, steals browser passwords and cookies, and exfiltrates data to command-and-control servers every five minutes.

Key Takeaway: Unit 42 attributes a decade-long, low-volume espionage operation to Iran, aimed at governments and businesses of multiple nations as well as its own citizens, with a separate 'Infy M' variant adding remote shell, screen capture and microphone capture against high-value targets.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related