Foudre

Foudre is a Windows-based first-stage espionage malware family associated with the Iranian threat actor Infy, also known as Prince of Persia. Active in campaigns observed since 2017 and used in operations that trace back to the group’s earlier activity, Foudre functions primarily as a lightweight downloader, backdoor, and victim-profiling implant. Its role is to establish an initial foothold, collect basic host information, perform reconnaissance on the compromised system, and determine whether the victim merits deployment of a more capable second-stage implant, most notably Tonnerre.

Foudre has been delivered through targeted phishing lures, including Persian-language documents and fake Excel-themed archives, as well as malicious Office documents containing macros or embedded executables packaged as self-extracting archives. In later campaigns, the malware was also reported in document-based delivery chains using embedded executables rather than relying solely on macros. Once executed, Foudre installs on the victim host, communicates with attacker-controlled infrastructure, and can download and launch follow-on payloads.

The malware is notable for resilient command-and-control design. Multiple versions use a domain generation algorithm to locate active infrastructure and authenticate command-and-control servers through RSA signature verification, complicating sinkholing and impersonation by defenders. Reporting also indicates newer Infy operations paired Foudre-family tooling with Telegram-backed command-and-control workflows, reflecting an evolution in the group’s operational security and infrastructure flexibility.

Foudre’s directly observed capabilities include host reconnaissance, keylogging in some versions, persistence, and staged payload delivery. It has been described as sending basic system information to operators, recording keystrokes, and retrieving encrypted archives containing second-stage malware. In the broader Infy intrusion chain, Foudre serves as the scout component, while Tonnerre is deployed selectively for deeper surveillance and data theft. Victimology linked to these campaigns includes Iranian dissidents, regional government entities, civil society targets, diplomats, journalists, and organizations in countries including Iran, Turkey, Iraq, India, Canada, and parts of Europe. The malware family reflects a long-running, adaptive cyber-espionage program focused on selective targeting, stealth, and durable access.