Topic starter
02/08/2026 12:02 pm
TL;DR: A state-linked threat actor is replacing C2 infrastructure, hiding victim data, testing a Telegram-based exfiltration path, and attempting a strike-back using a ZZ Stealer loader while Iran’s internet blackout appears to have disrupted activity, according to SafeBreach. The case reinforces that operational visibility, not just signature coverage, is what lets defenders spot infrastructure churn, channel abuse, and attribution signals early.
Editorial analysis by NHI Mgmt Group, based on content published by SafeBreach: “Prince of Persia, Part II: Covering Tracks, Striking Back & a Revealing Link to the Iranian Regime Amid the Country’s Internet Blackout”.
By the numbers:
- SafeBreach says it accessed more than 2,000 exfiltrated files in a two week period.
Key questions
Q: What failure mode does Prince of Persia show when attackers hide behind Telegram and rotating C2?
A: The failure mode is loss of traceability across the attacker’s control plane.
Q: Why does an internet blackout matter for state-linked intrusion operations?
A: A blackout can change the attacker’s available infrastructure, delay command activity, and interrupt exfiltration channels.
Q: What are the signs that covert C2 infrastructure is being actively managed?
A: Look for domain replacement, new certificates, backend code changes, altered log formats, and disappearing victim metadata.
Practitioner guidance
- Strengthen monitoring for covert Telegram use Correlate Telegram traffic, bot activity, and file transfers with endpoint alerts, especially where messaging platforms may be carrying command or exfiltration data.
- Track infrastructure replacement as a hunting signal Flag repeated C2 domain swaps, certificate reissuance, backend script changes, and log suppression as behaviour patterns rather than isolated indicators.
- Preserve victim and session traceability Keep IP, host, and file lineage in logging pipelines so attackers cannot erase attribution by rewriting filenames or omitting identifiers from logs.
Bottom line: Prince of Persia’s behaviour shows how a state-linked group can reduce visibility by replacing infrastructure, deleting logs, and hiding victim metadata while still keeping operations moving.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:08 pm
Blackout-aware threat hunting is now a governance requirement: When a state-linked actor’s activity tracks national connectivity conditions, defenders are not just looking for malware, they are looking for operational dependency. That changes how telemetry should be interpreted across endpoint, DNS, messaging, and proxy layers. A campaign can look dormant while actually waiting for infrastructure conditions to change, so incident response must account for environmental pauses as well as active compromise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should defenders respond when a threat actor uses messaging platforms for exfiltration?
A: Treat the platform as part of the attack path, not as a neutral transport. Correlate bot activity, forwarding patterns, unusual group membership, and file transfer events with endpoint and proxy telemetry. The goal is to identify whether a non-human channel is functioning as command, exfiltration, or both, before it becomes your blind spot.
👉 Read our full editorial: Prince of Persia shows how state actors cover tracks under blackout