Topic starter
25/10/2026 11:02 am
TL;DR: Semperis reports that Prince of Persia kept its command-and-control active in 2026 by changing hosting, panels and malware infrastructure. That churn means defenders need campaign-level correlation, not just IOC blocking, to track a resilient espionage setup.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Prince of Persia: Threat Group Hiding in Plain Sight”.
Key questions
Q: Why do DGA and Telegram-based callbacks make malware harder to block?
A: DGA creates many possible domains, while Telegram-based callbacks blend malicious traffic into an ordinary service that many organisations already allow.
Q: What are the signs that command-and-control infrastructure is being rebuilt after exposure?
A: Look for abrupt hosting changes, new certificates, emptying of victim-management files, repeated domain registration bursts and new panels that preserve the same malware workflow.
Q: How should security teams detect a multi-stage malware campaign that keeps changing infrastructure?
A: Treat each stage as part of one campaign rather than separate incidents.
Practitioner guidance
- Tune detections for staged malware behaviour Correlate loader activity, post-infection reconnaissance and exfiltration steps so the same intrusion is visible across multiple malware families.
- Monitor Telegram traffic for command-and-control patterns Flag unusual Telegram API use, especially when it coincides with suspicious host activity, new domains or certificate churn.
- Hunt for DGA-backed domain rotation Look for generated-looking domains, short registration lifetimes and repeated host changes that suggest a resilient callback network.
Bottom line: Prince of Persia uses layered malware and shifting infrastructure to preserve access even after exposure or takedown pressure.
Glossary terms: Command-and-control, Domain generation algorithm, Staged Malware Installer, Browser Credential Harvesting
What's in the full article
Semperis's full blog post covers the operational detail this post intentionally leaves for the source:
- Full IOC list for the Foudre, Tonnerre and Tornado infrastructure families
- Timeline details on the 2026 hosting and certificate changes across multiple C2 servers
- Specific exfiltration log examples showing how victim data was staged and retrieved
- Observed panel and domain patterns that can be turned into hunting logic
👉 Read Semperis’ analysis of Prince of Persia’s shifting command-and-control strategy →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
27/10/2026 7:17 pm
Infrastructure churn is now part of the attacker tradecraft, not just a cleanup detail. Prince of Persia did not merely lose and rebuild servers. It changed hosting styles, management panels and transport paths to keep the campaign alive after exposure. That means defenders have to treat infrastructure turnover as an operational phase of the intrusion, not a separate administrative event. The practical implication is to tie IOC management to campaign-level behaviour, not single-domain blocking.
A question worth separating out:
Q: How should teams respond when malware reaches browser credential material?
A: Treat it as an account-compromise scenario, not a routine endpoint cleanup case. Revoke exposed sessions, review related account activity, check for remote access and persistence, and investigate whether the payload accessed encrypted browser key material or local state files. Credential exposure changes the containment boundary.
👉 Read our full editorial: Prince of Persia’s shifting C2 strategy shows how APTs hide
This post was modified 5 hours ago by NHI Mgmt Group