News Detail

Infy Hackers Resume Operations with New Tactics

The Iranian threat group known as Infy, also referred to as Prince of Persia, has resumed its operations with new command-and-control (C2) servers. This development comes after the widespread internet blackout imposed by the Iranian regime at the start of January 2026 was lifted. Infy has been known for its elusive nature and has now evolved its tactics to further hide its tracks.

Notably, the threat actor ceased maintaining its C2 servers on January 8, marking the first such instance since observations began. This tactical shift indicates Infy's adaptability and determination to continue its cyber operations despite the challenges posed by the internet blackout.

• Infy's evolution in tactics suggests a high level of sophistication and awareness of cybersecurity measures.
• The group's ability to ready new C2 infrastructure coinciding with the end of the internet blackout underscores its preparedness and strategic planning.
• The use of new C2 servers is likely aimed at evading detection and maintaining the group's operational capabilities.

As cybersecurity landscapes continue to evolve, the resurgence of Infy's operations with enhanced tactics and infrastructure highlights the need for vigilance and advanced security measures to counter such threats.

Where curiosity meets code and security meets strategy.