On January 26, 2026, the Iranian hacking group known as Infy resumed operations, establishing new command-and-control (C2) servers. This activity coincided with the Iranian government easing internet restrictions, following a nationwide blackout that began on January 8, 2026. According to Tomer Bar, vice president of security research at SafeBreach, the group had not maintained its C2 infrastructure during the internet shutdown, indicating a possible lack of capability or motivation among government-affiliated cyber units to engage in malicious activities.
Infy, also referred to as the Prince of Persia, has been active since 2004, conducting espionage and sabotage operations aligned with Iran's strategic goals. The group has remained relatively under the radar compared to other state-sponsored actors. SafeBreach's recent report highlighted new tactics employed by Infy, including updates to their tools, Foudre and Tonnerre, with the latest being codenamed Tornado.
The report revealed that the latest version of Tornado (version 51) utilizes multiple methods for generating C2 domain names, including a new domain generation algorithm and fixed names derived from blockchain data. This innovative approach is believed to enhance the group's flexibility in managing its C2 infrastructure.