Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-IranTL-creat5161-en_EN:Bitdefender-PR-Whitepaper-IranTL-creat5161-en_EN.indd

Bitdefender researchers analyzed a decade-old Iranian APT known as Foudre and a new second-stage backdoor named Tonnerre: both delivered via malicious Office document and RAR SFX installers. The report details Foudre v23 and Tonnerre v11 capabilities — persistence, DGA-based C2, keylogging, screenshot and audio capture, targeted file collection and per-file encrypted archives for exfiltration — lists IOCs and C2 infrastructure, and reports sinkhole findings showing active callbacks from multiple IPv4/IPv6 hosts.