Infy Hackers Resume Operations with New C2 Servers After Iran Internet Blackout Ends

Iranian threat group Infy (aka Prince of Persia) has evolved its tactics and resumed operations with new C2 infrastructure. The group stopped maintaining C2 servers on January 8 during Iran's internet blackout and resumed activity on January 26, 2026. They introduced Tornado version 51 malware that uses both HTTP and Telegram for C2 communication, employing a new DGA algorithm and blockchain data de-obfuscation for C2 domain generation. The attackers weaponized WinRAR vulnerabilities using specially-crafted RAR archives containing AuthFWSnapin.dll (Tornado DLL) and reg7989.dll (installer). The malware establishes HTTP communication to download backdoors and uses Telegram bot API for data exfiltration. ZZ Stealer was also deployed as first-stage malware that collects environmental data, screenshots, and desktop files.