Iranian “Prince of Persia” APT Resurfaces with Telegram-Controlled Stealth Malware

According to SafeBreach Labs, the Iranian “Prince of Persia” APT—also known as Infy—has resurfaced after years of silence with a revamped toolkit and new command-and-control methods targeting Iran and Europe. The group’s latest effort centres on Telegram as its C2 channel, with the Tonnerre v50 malware designed to communicate with a Telegram group named “sarafraz” and a bot called “ttestro1bot” that appears to be operated by a human user, @ehsan8999100.

Researchers note that Telegram may be replacing the FTP protocols used by earlier versions, marking a shift in the group’s operational model. The threat landscape has expanded to include multiple new variants of Foudre v34 and Tonnerre v50, with Foudre delivered through undetectable Excel files rather than macro-heavy documents and Tonnerre employing unknown algorithms to generate command domains.

To evade detection, the operation leverages complex Domain Generation Algorithms that produce 10, 12, or 13-character domains with pattern-based substitutions that create a recognisable “fingerprint” for the attackers’ servers. The analysis concludes that the threat group remains active, relevant, and dangerous.