Prince of Persia shows how state actors cover tracks under blackout

At a glance

What this is: This is a threat-actor update showing Prince of Persia obscuring infrastructure, hiding victim traces, and using Telegram-linked exfiltration and strike-back activity during a period of blackout-linked disruption.

Why it matters: It matters because defenders need visibility into infrastructure churn, covert channels, and attribution signals, not just payload detection, when monitoring state-linked activity and NHI-enabled command paths.

By the numbers:

• SafeBreach says it accessed more than 2,000 exfiltrated files in a two week period.

Context

Prince of Persia sits in the overlap between state-linked intrusion tradecraft, covert infrastructure management, and non-human communication channels. The operational risk is not only malware delivery, but the way the group uses C2 churn, Telegram-based exfiltration, and identity-hiding techniques to reduce defender visibility.

For security teams, the key issue is governance of the telemetry layer itself. When an actor can rewrite logs, swap servers, and move exfiltration into a messaging platform, detection depends on correlated visibility across endpoints, network flows, and identity-linked artefacts rather than any single control.

The blackout dimension adds a broader operational signal: access to infrastructure, timing of activity, and tactical pauses can all change with external conditions. That makes this a useful case for defenders watching whether state-aligned operators depend on predictable communications windows or machine-managed channels.

Key questions

Q: What failure mode does Prince of Persia show when attackers hide behind Telegram and rotating C2?

A: The failure mode is loss of traceability across the attacker’s control plane. When a group can replace C2 servers, delete logs, suppress victim IPs, and move data through Telegram, defenders lose the consistent identifiers they need to connect activity over time. The result is delayed attribution, weaker containment, and more difficulty proving campaign scope.

Q: Why does an internet blackout matter for state-linked intrusion operations?

A: A blackout can change the attacker’s available infrastructure, delay command activity, and interrupt exfiltration channels. In this case, the pause in server maintenance and the later return of activity suggest that connectivity conditions affected campaign cadence. For defenders, that means operational context should influence hunting priorities and not be treated as background noise.

Q: What are the signs that covert C2 infrastructure is being actively managed?

A: Look for domain replacement, new certificates, backend code changes, altered log formats, and disappearing victim metadata. Those signs show the operator is adapting the control plane to stay usable while reducing analyst visibility. When several of them happen together, the infrastructure is being governed as a moving target rather than a fixed asset.

Q: How should defenders respond when a threat actor uses messaging platforms for exfiltration?

A: Treat the platform as part of the attack path, not as a neutral transport. Correlate bot activity, forwarding patterns, unusual group membership, and file transfer events with endpoint and proxy telemetry. The goal is to identify whether a non-human channel is functioning as command, exfiltration, or both, before it becomes your blind spot.

Technical breakdown

How Telegram became part of the exfiltration path

Telegram can act as a covert transport layer when attackers use bots, forwarding, or private groups to move victim data outside normal C2 channels. In this case, the group used Telegram alongside HTTP-based infrastructure, which gives the operator redundancy and makes traffic harder to separate from ordinary messaging activity. The security problem is not that Telegram is inherently malicious, but that an attacker-controlled account or bot can become a non-human communication endpoint for command and exfiltration. That shifts the detection burden from malware signatures to behavioural and metadata analysis.

Practical implication: monitor messaging-platform use as a potential NHI-like control plane and correlate it with endpoint and proxy telemetry.

Why infrastructure churn weakens simple blocking models

Replacing C2 servers, rotating domains, and modifying backend code to hide victim identifiers are all forms of operational security designed to frustrate attribution and blocklisting. Once the infrastructure is dynamic, a static indicator list becomes stale quickly, especially when the actor uses multiple malware variants and fallback protocols. The more important pattern is the lifecycle of the infrastructure itself: registration, certificate issuance, abandonment, and reappearance. That is a governance problem as much as a detection problem, because it tests whether defenders can track the actor’s behaviour rather than just its addresses.

Practical implication: treat infrastructure churn as a detection signal and watch for repeated domain, certificate, and backend-code changes.

What the blackout suggests about state-linked operational dependence

When activity stops and restarts in line with a national internet shutdown, the observed pause can indicate that the threat operation depends on the same connectivity constraints that affect the broader state environment. That does not prove every operator decision, but it does show how geopolitical conditions can alter campaign cadence. For defenders, this matters because the actor’s timing, command availability, and exfiltration options may vary in ways that signature-based tools do not capture. Operational context becomes part of threat assessment, not just background noise.

Practical implication: include geopolitical connectivity shifts in threat hunting assumptions and update monitoring thresholds when outages occur.

Threat narrative

Attacker objective: The attacker appears to want persistent covert access, concealed victim identity, and a resilient exfiltration and counter-detection pipeline that survives infrastructure disruption.

1. Entry occurred through a public WinRAR vulnerability and later through ZIP, LNK, and PowerShell loader chains used to drop ZZ Stealer.
2. Credential and data handling then shifted through C2 logs, exfiltration files, and Telegram channels that carried victim material and commands.
3. Escalation focused on concealment, with the actor replacing servers, deleting logs, masking victim IP data, and testing a strike-back payload against researchers.
4. Impact was operational opacity, continuing exfiltration, and an attempted counter-infection path that complicated attribution and response.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blackout-aware threat hunting is now a governance requirement: When a state-linked actor’s activity tracks national connectivity conditions, defenders are not just looking for malware, they are looking for operational dependency. That changes how telemetry should be interpreted across endpoint, DNS, messaging, and proxy layers. A campaign can look dormant while actually waiting for infrastructure conditions to change, so incident response must account for environmental pauses as well as active compromise.

Telegram is functioning as an operational channel, not just a messaging app: This case shows how a messaging platform can become part of the attacker’s control and exfiltration plane. That matters for identity governance because the platform-mediated account, bot, or group becomes a non-human access path that can move files, commands, and signals outside normal enterprise oversight. The practical conclusion is that covert channel monitoring belongs in the same discussion as NHI and workload communication controls.

Infrastructure churn is the real signature here: The article describes repeated replacement of C2 servers, log deletion, victim-IP suppression, and changes to backend code. Those are not random changes, they are a named pattern of visibility suppression: the attacker is trying to make victims, analysts, and attribution models see less than is actually happening. Security programmes that only optimise for payload detection will miss this governance layer, so defenders need controls that preserve traceability across the full campaign lifecycle.

The campaign reinforces that state actors now manage their malicious infrastructure like a service catalogue: Multiple malware families, changing protocols, and alternate exfiltration routes indicate a mature operations model rather than one-off tooling. That makes the threat closer to a managed identity and access problem than a single intrusion event, because the operator is continuously reissuing, replacing, and hiding the channels it uses. Teams should treat this as a sign to harden control-plane visibility, not just endpoint detection.

Prince of Persia appears to illustrate operational resilience under pressure: The actor’s behaviour suggests an adaptive programme that can pause, reconstitute, and re-route when the environment changes. That is why the most useful defender response is not a one-time blocklist, but a programme that links threat intelligence, identity of control channels, and infrastructure telemetry into one view. The conclusion for practitioners is to assume continuity of intent even when execution changes shape.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Top 10 NHI Issues

What this signals

Visibility suppression is the strongest concept this case adds to NHI governance thinking: the actor is not only moving data, it is actively rewriting what defenders can observe. That pattern should push security teams to review where traceability depends on mutable logs, mutable channels, or third-party messaging services. The more an adversary can change identifiers after the fact, the less useful retrospective hunting becomes.

State-linked operators increasingly blend infrastructure management with covert communications, which means identity and access thinking has to extend to the channels that carry commands and exfiltration. When a messaging platform functions as a control path, the practical question is not only who has access, but what the channel is allowed to do and how that activity is logged. For practitioners, this is a strong argument for building channel-level detections alongside endpoint and network controls.

For practitioners

• Strengthen monitoring for covert Telegram use Correlate Telegram traffic, bot activity, and file transfers with endpoint alerts, especially where messaging platforms may be carrying command or exfiltration data.
• Track infrastructure replacement as a hunting signal Flag repeated C2 domain swaps, certificate reissuance, backend script changes, and log suppression as behaviour patterns rather than isolated indicators.
• Preserve victim and session traceability Keep IP, host, and file lineage in logging pipelines so attackers cannot erase attribution by rewriting filenames or omitting identifiers from logs.
• Validate exposure to loader chains and archive abuse Hunt for ZIP, LNK, and PowerShell execution chains that unpack secondary payloads into startup or user-writable locations, especially where archive files arrive through messaging channels.
• Update detection assumptions for connectivity shocks Treat national outages, internet blackouts, and other connectivity disruptions as periods when adversary cadence may pause, resume, or shift transport methods.

Key takeaways

• Prince of Persia’s behaviour shows how a state-linked group can reduce visibility by replacing infrastructure, deleting logs, and hiding victim metadata while still keeping operations moving.
• The article’s strongest evidence is not just in the payloads, but in the way Telegram and changing C2 assets form a durable covert control layer.
• Defenders need telemetry that preserves traceability across changing channels and infrastructure, because static indicators age out faster than the campaign adapts.

Key terms

• Command and control infrastructure: The systems an attacker uses to send instructions to compromised hosts and receive data back. In malware operations, C2 is often built to survive takedowns, rotate domains, and hide inside normal network traffic so defenders cannot easily separate malicious from legitimate communication.
• Exfiltration Channel: An exfiltration channel is any route through which data can leave an organisation, including browsers, cloud apps, email, collaboration tools, removable media, and AI assistants. Effective governance requires visibility across all relevant channels, not just endpoints, because attackers and insiders often choose the path that is least monitored.
• Infrastructure Churn: Infrastructure churn is the repeated replacement of domains, servers, certificates, or delivery paths to keep a campaign operational under pressure. It is a resilience tactic for attackers because it forces defenders to track behavior patterns rather than fixed indicators.
• Traceability Suppression: Traceability suppression is the deliberate removal or distortion of evidence that links malicious actions to their source. Examples include deleting logs, masking victim IP addresses, or rewriting filenames. It matters because it attacks the defender’s ability to reconstruct the attack chain after the fact.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern machine identities, secrets, and access paths across real operational environments.