Foudre
Foudre is a custom first-stage malware family used by the Iranian threat actor Infy, also known as Prince of Persia. It has been active in campaigns observed since 2017 and remains in use in updated variants alongside Tonnerre, which it can download and execute as a second-stage implant for deeper espionage, surveillance, and data exfiltration. Foudre functions primarily as a lightweight downloader, reconnaissance tool, and victim profiler: it collects basic system information, maps victim identity, and helps operators decide whether a target is valuable enough to receive Tonnerre. Reporting describes it as a “scout” or triage implant, and notes that operators may remove it from lower-value victims while escalating selected targets.
Observed infection vectors include phishing emails, malicious or fake Microsoft Excel files, ZIP archives, and Excel documents containing embedded executables or self-extracting archives. In some campaigns, execution dropped a self-extracting archive that silently installed the Foudre backdoor; examples include fake Excel lures and archives such as Notable Martyrs.zip. Recent reporting also states that Infy shifted some initial access to exploitation of a WinRAR vulnerability to extract newer related payloads into Startup, though that reporting is tied more directly to Tornado/Tonnerre evolution than to Foudre alone.
Foudre has evolved substantially over time. Recent variants include Foudre v34 and other active versions operating in parallel with different DGAs. The malware uses domain generation algorithms for command-and-control resilience, and reporting states that Foudre can generate candidate C2 domains and validate them using RSA signature verification, preventing easy sinkholing or impersonation of C2 infrastructure without the actor’s private key. Newer campaigns also leveraged Telegram-backed C2 infrastructure, and Infy was observed sustaining Foudre and Tonnerre operations with Telegram-based C2 targeting Iranian dissidents and regional government entities. SafeBreach reported at least three active Foudre/Tonnerre variants in parallel, with rotating C2 servers, new DGA domains, deletion of communication logs, redaction of victim IPs to 0.0.0.0 in exfiltration filenames, and selective victim handling.
Foudre has been associated with espionage targeting Iranian dissidents, journalists, diplomats, civil society, and regional government entities, with most victims reportedly in Iran and additional victims in Iraq, Turkey, India, Canada, and Europe. It has also appeared in layered Infy toolsets alongside Tonnerre, MaxPinner, Amaq News Finder, Deep Freeze, and Rugissement. High-confidence behavioral details directly mentioned in the source include basic system profiling, staged delivery of Tonnerre, use of DGAs, RSA-based C2 validation, phishing/document-based delivery, and use in Telegram-enabled C2 ecosystems operated by Infy/Prince of Persia.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“Infy is also exploiting a zero-day vulnerability in WinRAR (CVE-2025-8088 or CVE-2025-6218) to deploy the Tornado payload.”
“Infy is also exploiting a zero-day vulnerability in WinRAR (CVE-2025-8088 or CVE-2025-6218) to deploy the Tornado payload.”
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Infy sustained Foudre and Tonnerre variant operations with Telegram-based C2 targeting Iranian dissidents.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Command and Control
2 techniquesFinally, for command and control and exfiltration, Iranian-linked groups most commonly rely on application layer protocols (T1071), such as HTTP
“Prince of Persia… using a domain generation algorithm… multiple… variants of Foudre and Tonnerre using different DGA in parallel…”
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware variant used by Infy with Telegram-based C2 targeting Iranian dissidents.
Malware variant used with Telegram-based command-and-control to target Iranian dissidents and regional government entities.
One of Infy’s core proprietary malware families used in its resurfaced espionage operations.
A named Infy-associated malware family referenced as being actively maintained/updated by the group.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.