Prince of Persia’s C2 hiding tactics: what should defenders watch?

TL;DR: The Iranian nation-state group Prince of Persia changed its command-and-control strategy in 2026, according to Semperis, shifting hosting, panels and malware infrastructure while using DGA, Telegram and shared hosting to keep Foudre, Tonnerre and Tornado active. The case shows that infrastructure churn is now a governance problem, not just a detection problem.

Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Prince of Persia: Threat Group Hiding in Plain Sight”.

Key questions

Q: How should security teams detect a multi-stage malware campaign that keeps changing infrastructure?

A: Treat each stage as part of one campaign rather than separate incidents.

Q: Why do DGA and Telegram-based callbacks make malware harder to block?

A: DGA creates many possible domains, while Telegram-based callbacks blend malicious traffic into an ordinary service that many organisations already allow.

Q: What are the signs that command-and-control infrastructure is being rebuilt after exposure?

A: Look for abrupt hosting changes, new certificates, emptying of victim-management files, repeated domain registration bursts and new panels that preserve the same malware workflow.

Practitioner guidance

• Tune detections for staged malware behaviour Correlate loader activity, post-infection reconnaissance and exfiltration steps so the same intrusion is visible across multiple malware families.
• Monitor Telegram traffic for command-and-control patterns Flag unusual Telegram API use, especially when it coincides with suspicious host activity, new domains or certificate churn.
• Hunt for DGA-backed domain rotation Look for generated-looking domains, short registration lifetimes and repeated host changes that suggest a resilient callback network.

Bottom line: Prince of Persia uses layered malware and shifting infrastructure to preserve access even after exposure or takedown pressure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →