Prince of Persia’s shifting C2 strategy shows how APTs hide

At a glance

What this is: Semperis analyses how Prince of Persia altered its command-and-control infrastructure, malware staging and exfiltration channels to stay hidden across 2026.

Why it matters: Identity and security teams need to treat stealth infrastructure, callback channels and host-based trust as governance issues because malware operators can rotate them faster than standard hygiene catches up.

Context

Prince of Persia is a long-running nation-state intrusion set that uses multi-stage malware and remote command infrastructure to keep access durable across takedowns and investigations. The core problem is not just compromise, but the attacker’s ability to keep rebuilding infrastructure and changing transport so defenders lose sight of the same campaign.

For identity and access teams, the interesting part is how the malware chain reaches into credentials, browser artefacts and machine identity signals to decide whether a victim is worth deeper exploitation. That makes this a hybrid identity hardening problem as much as it is a malware-tracking problem.

Key questions

Q: How should security teams detect a multi-stage malware campaign that keeps changing infrastructure?

A: Treat each stage as part of one campaign rather than separate incidents. Correlate loader activity, command-and-control changes, credential harvesting and exfiltration patterns across time. That approach catches actors that rotate domains, panels and hosting while keeping the same operational objective. Static indicators alone are usually too brittle against this model.

Q: Why do DGA and Telegram-based callbacks make malware harder to block?

A: DGA creates many possible domains, while Telegram-based callbacks blend malicious traffic into an ordinary service that many organisations already allow. Together, they reduce the value of simple blocklists and IP reputation checks. Defenders need behaviour-based detections that look at certificate patterns, domain churn and host activity, not only network destinations.

Q: What are the signs that command-and-control infrastructure is being rebuilt after exposure?

A: Look for abrupt hosting changes, new certificates, emptying of victim-management files, repeated domain registration bursts and new panels that preserve the same malware workflow. Those signs often mean the actor is reconstituting its command layer after discovery rather than retiring the campaign. That is especially important in long-lived espionage sets.

Q: How should teams respond when malware reaches browser credential material?

A: Treat it as an account-compromise scenario, not a routine endpoint cleanup case. Revoke exposed sessions, review related account activity, check for remote access and persistence, and investigate whether the payload accessed encrypted browser key material or local state files. Credential exposure changes the containment boundary.

Technical breakdown

How multi-stage malware supports persistent command and control

Prince of Persia’s tooling shows a layered malware model. Foudre acts as the first-stage loader, establishing initial access, collecting host details and deciding whether the victim is valuable enough to progress. Tonnerre then expands into surveillance and exfiltration, while Tornado adds more resilient delivery and callback paths. This separation lets the actor change one component without discarding the whole campaign. For defenders, that means a single indicator set rarely maps to the whole intrusion set. Telemetry has to link loader behaviour, callback infrastructure and post-compromise activity across stages. See the Threat Actor Groups Guide.

Practical implication: Build detections around the full staging chain, not isolated binaries or domains.

Why Telegram and DGA matter in modern callback infrastructure

Telegram-based command and control creates traffic that can blend with legitimate application use, especially when the malware pulls configuration dynamically instead of hard-coding all endpoints. DGA adds a second layer of resilience by generating many candidate domains, which makes takedown and blocklist approaches less durable. When these techniques are combined, the attacker can pivot infrastructure without redeploying the malware. The architectural point is that the control plane becomes mobile while the payload stays relatively stable. That raises the cost of relying on static indicators alone.

Practical implication: Correlate DGA-like domain patterns with unusual Telegram use before the callback path is fully established.

How shared hosting and public cloud hosting change the defender’s job

The shift from VPS infrastructure to shared hosting and then to Cloudflare-backed services shows how hostile operators exploit ordinary internet services to reduce their visibility. This is not unique to this actor, but it matters because the hosting layer is no longer a reliable trust signal. A malicious panel can sit beside benign tenants, which weakens simple reputation-based filtering. Defenders need to understand the service context, not just the IP address. In this case, hosting choice is part of the stealth strategy, not an incidental detail.

Practical implication: Inspect hosting context and service abuse patterns instead of trusting infrastructure reputation alone.

Threat narrative

Attacker objective: The objective is durable espionage access that enables selective surveillance, credential theft and sustained file exfiltration without losing command of infected hosts.

1. Entry came through one-day software vulnerabilities and other initial compromise paths that dropped first-stage malware into target environments.
2. Credential access and victim profiling followed as Foudre and Tonnerre harvested browser credentials, cookies, host data and surveillance artefacts.
3. Escalation and persistence were maintained through staged malware, rotating domains, Telegram channels and DGA-backed command infrastructure.
4. Impact was long-term espionage and file exfiltration, including large-scale document theft from selected victims.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Infrastructure churn is now part of the attacker tradecraft, not just a cleanup detail. Prince of Persia did not merely lose and rebuild servers. It changed hosting styles, management panels and transport paths to keep the campaign alive after exposure. That means defenders have to treat infrastructure turnover as an operational phase of the intrusion, not a separate administrative event. The practical implication is to tie IOC management to campaign-level behaviour, not single-domain blocking.

The identity angle in this campaign sits inside the malware, not around the perimeter. Foudre and Tonnerre actively profile systems, steal browser credentials and decide whether a victim deserves deeper infection. That creates a direct intersection with hybrid identity hardening because stolen authentication artefacts become a stepping stone to access persistence. The practical implication is to watch for identity artefact theft as a precursor to broader compromise, not as a post-infection side effect.

Callback trust gap: attackers exploit the difference between what looks like normal internet traffic and what actually serves command and control. Telegram traffic, DGA and shared hosting all help create that gap. Once defenders rely too heavily on IP reputation or isolated indicators, the campaign can survive by moving one layer up or down the stack. The practical implication is to correlate transport, certificate and payload behaviour in the same detection logic.

Stealth hosting is becoming a governance issue for threat hunting and intelligence teams. The same infrastructure family can move from VPS to shared hosting to cloud-backed services without changing its malicious purpose. That weakens assumptions about where malicious infrastructure “should” live. The practical implication is to build hunt logic around service abuse patterns, domain generation and panel behaviour rather than provider type alone.

Nation-state espionage campaigns increasingly resemble living service stacks. The malware family evolves, the command layer changes and the exfiltration channel shifts, but the operational objective stays stable. This pattern argues for continuous campaign tracking rather than event-by-event response. The practical implication is to manage these groups as persistent programmes of activity, not one-off incidents.

Read next: Active Directory and Entra ID Hardening Guide

What this signals

Callback trust gap: defenders increasingly face malware that hides in ordinary services while keeping the same control relationship to infected hosts. That means network reputation, certificate age and hosting style should be treated as correlated signals, not independent comfort checks.

Prince of Persia’s behaviour suggests that infrastructure exposure does not end an espionage campaign. When operators can rebuild panels, shift hosting and preserve exfiltration paths, programme owners need response models that assume persistence after discovery, not recovery after disruption.

For practitioners

• Tune detections for staged malware behaviour Correlate loader activity, post-infection reconnaissance and exfiltration steps so the same intrusion is visible across multiple malware families.
• Monitor Telegram traffic for command-and-control patterns Flag unusual Telegram API use, especially when it coincides with suspicious host activity, new domains or certificate churn.
• Hunt for DGA-backed domain rotation Look for generated-looking domains, short registration lifetimes and repeated host changes that suggest a resilient callback network.
• Review browser credential exposure on infected hosts Treat cookie theft, saved credentials and environment profiling as signs of deeper compromise rather than isolated malware behaviour.
• Map hostile infrastructure by service abuse, not by provider name Use hosting context, panel behaviour and certificate patterns to identify malicious infrastructure that blends into ordinary services.

Key takeaways

• Prince of Persia uses layered malware and shifting infrastructure to preserve access even after exposure or takedown pressure.
• The article shows how staged loaders, Telegram callbacks, DGA and hosting churn combine to keep espionage infrastructure resilient.
• Defenders need campaign-level detection, identity artefact monitoring and infrastructure correlation rather than isolated IOC blocking.

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide · Threat Actor Groups Guide · Cloud Network Security Guide · Salt Typhoon telecom intrusions 2025

Key terms

• Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.
• Domain generation algorithm: A domain generation algorithm is code that creates many possible command-and-control domains, usually on a schedule or from seed values. It helps malware recover from server loss and frustrates blocklists because defenders must predict the next set of domains rather than block a fixed address.
• Staged Malware Installer: A staged malware installer is a package or script that uses an initial, apparently ordinary delivery step to fetch a second payload from elsewhere. In supply-chain attacks, the first stage often hides malicious behavior behind build or install activity, then hands execution to a separate archive, runtime, or native component.
• Browser Credential Harvesting: The extraction of passwords, cookies, and session material from browsers or local storage after an endpoint compromise. These artifacts often function like active credentials, so their theft can enable immediate reuse, account takeover, or lateral access without additional authentication.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the wider attack paths that modern malware uses.