Prince of Persia’s evolving C2 and malware tradecraft under the microscope

At a glance

What this is: SafeBreach maps Prince of Persia’s evolving malware, C2 infrastructure, and command channels to show the group was still active in 2025.

Why it matters: For defenders, the lesson is that persistent APT monitoring has to correlate malware lineage, infrastructure patterns, and operator behaviour, not just alert on isolated samples.

Context

Prince of Persia is a long-running APT campaign, and the core governance problem is visibility into an actor that changes malware, infrastructure, and command paths over time. When defenders focus on one sample or one server, they miss the continuity that links old activity to new tradecraft, especially in campaigns that blend patient infrastructure reuse with tactical change.

For identity and security teams, the interesting part is not just malware mechanics but the control-plane lesson: persistent adversaries evade detection by shifting the relationship between endpoints, C2, and operator accounts. That makes telemetry correlation, infrastructure hunting, and campaign lineage tracking central to threat monitoring rather than optional research work.

Key questions

Q: What does a changing malware family tell defenders about an APT campaign?

A: It usually means the actor is preserving the mission while rotating tooling, infrastructure, and delivery paths. Defenders should assume continuity when they see repeated operator habits, C2 structures, or loader behaviour, even if hashes and domains change. The practical goal is campaign linkage, not sample isolation.

Q: Why do staged loaders make threat hunting harder?

A: Because the first-stage payload can look like a limited intrusion or a failed delivery until it fetches the second stage. That creates a false sense of closure if teams only look for the final malware family. Hunting must therefore treat loader execution, victim mapping, and conditional retrieval as part of the compromise chain.

Q: How should teams detect abuse of legitimate messaging platforms for C2?

A: Look for bot tokens, unusual group membership, repeated API calls, and data-moving behaviour that aligns with malware execution or exfiltration. The key is to baseline normal collaboration use first, then alert on command-like patterns, automation artefacts, and endpoint processes that should not be talking to messaging infrastructure.

Q: How do security teams keep visibility when adversaries rotate infrastructure?

A: They need lineage-based hunting, not just IOC replacement. That means tying domains, directory structures, payload roles, and operator timing together so one new server does not break the incident picture. The best results come from combining DNS, proxy, endpoint, and malware-analysis telemetry into one campaign view.

Technical breakdown

How Foudre and Tonnerre split roles in the intrusion chain

Foudre and Tonnerre operate as a staged malware pair rather than a single payload. Foudre acts as the first-stage loader and victim mapper, then conditionally fetches Tonnerre when the target is worth deeper access. That split matters because it reduces exposure for lower-value victims while preserving a richer operator path for selected systems. The article shows multiple Foudre and Tonnerre versions in parallel, which indicates an iterative campaign architecture rather than a one-off toolset. For defenders, that means sample-level detection is weaker than campaign-level correlation.

Practical implication: hunt for loader-to-payload relationships and not just isolated hashes.

How DGA-driven C2 gives operators resilience

Domain generation algorithms, or DGAs, let malware produce many candidate command-and-control domains so the operator can rotate infrastructure quickly. In this campaign, SafeBreach observed both original CRC32-based DGAs and newer multi-stage or unknown DGA variants, including parallel infrastructure for different malware versions. That matters because infrastructure churn is part of the design, not evidence that the actor is disappearing. Detection therefore has to look for family behaviour, registrar patterns, DNS anomalies, and repeated directory structures rather than fixed hostnames alone.

Practical implication: add DGA-aware hunting to DNS and proxy telemetry.

Why Telegram became a command and exfiltration channel

The newer Tonnerre variant redirected victims to a Telegram group and used a bot token to issue commands and retrieve exfiltrated data. That is a notable shift because the operator is no longer relying only on classic FTP-style transfer paths, but on a platform that can absorb command exchange into ordinary cloud traffic. The article also suggests Telegram may replace earlier exfiltration methods. For defenders, this is a reminder that abuse of legitimate collaboration platforms can hide inside normal SaaS usage patterns unless traffic, tokens, and process behaviour are correlated.

Practical implication: monitor legitimate messaging platforms for bot-driven command and data flow anomalies.

Threat narrative

Attacker objective: The actor’s objective is long-term espionage, victim selection, and controlled exfiltration while maintaining campaign continuity across changing infrastructure.

1. Entry used malicious Excel files and embedded executables to deliver Foudre to the victim environment.
2. Credentialed or selected victim paths were then mapped by Foudre, which decided whether to fetch Tonnerre for deeper operator control.
3. Escalation occurred through DGA-backed C2 infrastructure and staged command channels, including Telegram-based control in newer variants.
4. Impact was sustained espionage, victim file exfiltration, and long-lived campaign persistence across multiple C2 generations.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Infrastructure lineage is the real unit of analysis in persistent APT monitoring. Single samples tell defenders very little when the actor can rotate loaders, DGAs, and C2 layouts without changing the campaign objective. The article shows why researchers must correlate malware families, directory structures, and operator behaviour over time. For practitioners, the takeaway is that campaign memory is itself a defensive control.

Telegram-based command and exfiltration turns legitimate SaaS into a control surface. When malware uses a bot and group membership to manage victims, the trust boundary shifts from classic malware infrastructure to a service that many organisations already allow. That does not make the platform the problem; it makes the governance gap the inability to distinguish normal collaboration traffic from operator control. For defenders, the implication is broader SaaS telemetry scrutiny, not platform blind trust.

Multi-stage loaders are a visibility evasion pattern, not just a malware design choice. Foudre’s role as a first-stage mapper and Tonnerre’s role as a deeper payload show a control strategy that limits noise and concentrates capability on selected victims. That pattern matters to threat hunting because the absence of a second-stage payload is not evidence of safety. Practitioners should treat first-stage execution as a meaningful compromise signal, even when follow-on activity is delayed.

Prince of Persia illustrates the value of named campaign concepts for operational defence. A useful shorthand here is campaign continuity drift, the tendency for an actor to preserve mission and operator habits while changing everything defenders usually key on. The article’s evidence fits that pattern closely, from older Foudre behaviours to newer Telegram-linked flows. For practitioners, the conclusion is clear: build detections around durable behaviours, not around the latest hash or domain set.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Infrastructure Workload Identity Guide

What this signals

Campaign continuity drift: the most useful defensive concept in this article is the idea that an adversary can preserve its campaign identity while changing the observable mechanics that analysts normally track. That shifts the programme requirement from IOC refresh to behaviour correlation across malware generations, infrastructure layers, and operator actions.

SafeBreach’s research is a reminder that visibility failures are often programme failures, not tooling failures. Only 5.7% of organisations have full visibility into their service accounts, and the same blind-spot logic applies when defenders cannot connect first-stage loaders, C2 churn, and exfiltration behaviour into one story.

For practitioners

• Track campaign lineage, not just malware hashes Correlate loader behaviour, C2 directory patterns, and DGA characteristics across samples so a renamed variant still maps to the same adversary activity.
• Hunt for staged payload execution Flag first-stage droppers that map the victim, then fetch a second payload only for selected hosts, because that selection step often marks true operator control.
• Monitor Telegram-linked control paths Inspect bot tokens, group-based command patterns, and unusual Telegram API use when SaaS traffic coincides with exfiltration or remote control behaviour.
• Add DGA-aware DNS hunting Search for rotating domains, parallel DGAs, and repeated C2 directory structures so infrastructure churn does not reset the detection timeline.

Key takeaways

• Prince of Persia shows how a long-running APT can stay operational by changing malware, C2 design, and command paths without changing its underlying campaign purpose.
• The article ties multiple Foudre and Tonnerre variants to parallel DGA infrastructure and Telegram-based control, which is a strong signal of active operator adaptation.
• Defenders need campaign-level correlation and infrastructure hunting, because hash-based detection alone will miss adversaries that deliberately shift the surface defenders use to identify them.

Key terms

• Command and control infrastructure: The systems an attacker uses to send instructions to compromised hosts and receive data back. In malware operations, C2 is often built to survive takedowns, rotate domains, and hide inside normal network traffic so defenders cannot easily separate malicious from legitimate communication.
• Domain generation algorithm: A domain generation algorithm is code that creates many possible command-and-control domains, usually on a schedule or from seed values. It helps malware recover from server loss and frustrates blocklists because defenders must predict the next set of domains rather than block a fixed address.
• Loader Malware: Loader malware is code whose main job is to establish execution and fetch a later payload rather than deliver the full attack immediately. It often gathers basic telemetry, checks environment details, and then retrieves a second stage that can be updated independently by the attacker.
• Campaign lineage: Campaign lineage is the relationship between related malware samples, infrastructure choices, and operator habits over time. It helps analysts connect apparently separate events into one adversary programme, which is essential when the actor changes tooling faster than defenders can track individual artefacts.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners build the governance discipline needed to control modern access ecosystems.