Iran-linked Prince of Persia APT Resurfaces with Sophisticated Malware Campaigns

Du'aine Davis

Observed in the wild

• Iranian state-sponsored APT group “Prince of Persia” has resumed large-scale cyber campaigns after appearing dormant since 2022. Recent activity (2023–2025) targeted Iranian dissidents and critical infrastructure globally, with confirmed infections across Iran, Europe, and parts of Asia. SafeBreach research uncovered multiple new malware variants (Foudre v34, Tonnerre v17/v50) and C2 servers active as recently as December 2025.
• Attackers deployed advanced malware families (Foudre, Tonnerre, MaxPinner) via malicious Microsoft Excel files, macros, and embedded executables. They leveraged custom DGA algorithms, Telegram-based C2 channels, and encrypted SFX loaders for persistence and exfiltration. Infrastructure included multiple evolving C2 servers and domains, with Telegram bots replacing older FTP-based data transfer methods, indicating increased operational security and sophistication.
• Organisations should monitor for suspicious Excel files with embedded executables, DGA-based domain patterns, and Telegram API traffic. Microsoft Defender users should enable advanced threat protection, block macros from untrusted sources, and configure network indicators to detect anomalous HTTP GET requests to C2 structures.

Unmasking the Evolving Iranian Prince of Persia | SafeBreach