Researchers Disrupt Iranian Cyberespionage Campaign | SecurityWeek.Com

Researchers at Palo Alto Networks disrupted an Iran-linked cyberespionage campaign using the 'Infy' malware family, sinkholing C2 domains and uncovering over 450 compromised agents on 326 systems across 35 countries; multiple variants exist (including the more capable Infy M), the malware primarily stole files (older variants recorded video) and continued evolving after disclosure. Although the campaign was largely shut down by domain takedowns, attackers changed infrastructure and released new variants, and researchers expect the threat actor may return.