Unmasking the Evolving Iranian Prince of Persia | SafeBreach By Author:  Tomer Bar, VP Security Research, SafeBreach Archived: 2026-04-05 18:54:00 UTC Iranian state-sponsored threat actors have been targeting networks and critical infrastructure organizations across the globe—as well as dissidents of the Iranian regime—since the early 2000s. In 2016, Palo Alto Networks’ Unit 42 identified one such threat actor known as “Infy” or “Prince of Persia,” with evidence of their activity targeting victims in Iran and Europe dating back to 2007. In 2017, activity by the group was observed again through the use of a new malware variant, dubbed Foudre. SafeBreach Labs has followed the Prince of Persia group since 2019, and our own original research in 2021 presented evidence that they had dramatically reinforced their operations security activities, technical proficiency, and tooling capabilities. However, for the next three years, there was no publicly identified activity from the group. Our research team continued to hunt for evidence based on a variety of anchors and patterns we had defined. As a result, we were able to maintain unprecedented visibility into their malicious activity during this time.  In the blog below, we first outline the key findings and takeaways of our most recent research targeting the Prince of Persia threat actor, revealing critical new details that will help other security researchers and cybersecurity professionals better understand—and defend against—this evolving threat. Next, we will provide a high-level overview of previous research on this threat actor that reveals important context about their motivations and activities over the last decade. Then, we will dive into an in-depth analysis of several new malware variants discovered during our latest research campaign, including Foudre v34, Tonnerre v17, Tonnerre v50, an unknown Foudre version, and more. Finally, we provide an appendix that outlines relevant indicators of compromise (IoCs).  Key Findings  Our latest research targeting the Prince of Persia threat actor group uncovered the following new details  and key takeaways regarding the group’s activity over the last three years:  The scale of Prince of Persia’s activity is more significant than we originally anticipated. Our research identified multiple campaigns that used a large number of malware variants and C2 servers. There are at least three active variants of Foudre and Tonnerre using different DGA in parallel and communicating to an active C2 server. Tonnerre v50—which was detected as recently as September 2025 and uses an unknown DGA algorithm. Tonnerre v12-16, which uses the original CRC32 based DGA Tonnerre v17, which uses the original CRC32 as the first stage and then adds a second-stage DGA algorithm. https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 1 of 32 For the first time since 2016, we discovered that the new Tonnerre v50 malware is redirected by the C2 server to a Telegram group, which includes a Telegram bot that likely uses the Telegram API to send commands and get the exfiltrated victim’s data. Telegram may be used as a replacement to the FTP protocol used by former versions of Tonnerre. The Telegram group name in Persian is ”سرافراز“, pronounced “sarafraz” in English which translates to “proudly.” Beside the bot is a Persain user name: @ehsan8999100. This user is probably one of the Iranian hackers behind Prince of Persia. Below is a screenshot taken on December 14, 2025, showing the user had been active the day before. Our research identified additional unknown variants that are similar to Tonnerre that were probably used to download and execute Foudre: Two versions of the Amaq News Finder and Deep Freeze variants.  New variants of the MaxPinner malware family, which focuses on spying on Telegram’s content.  Another unknown malware family named Rugissement, which includes variants that are probably unknown attack vectors used in 2019-2021.  We found Foudre v34, which was publicly available, and Tonnerre v17, which we captured ourselves.  The threat actor is using multiple C2 servers. Despite their prevention efforts, we were able to consistently download the victim files exfiltrated by Foudre and Tonnerre from all C2 servers, including the older C2 servers from 2021 and the newer version from September 2025. Most of the C2 servers we found in the last two years appear to be used for testing purposes by the threat actor, with a limited number of real victims. We believe sharing the characteristics of the discovered testing C2 servers will help other security researchers discover additional “production” C2 servers.  Background In 2016, Palo Alto Networks’ Unit 42 initially discovered Prince of Persia, an APT group that appeared to have ties to the Iranian government. Researchers at Qi-Anxin’s Threat Intelligence Center investigated a specific attack https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 2 of 32 targeting Danish diplomats—named Operation Mermaid—that appeared to use the same methods and infrastructure associated with the group. After the publication, Unit 42 conducted a takedown operation. This gave the researchers more visibility into the origin of victims, the motive of the attackers, and the scope of the attack. The data gathered reaffirmed the Iranian connection—most victims were either in Iran, or were Iranian dissidents, and the attackers did not seem to be financially motivated. As a result of the takedown, Prince of Persia lost access to almost all of the campaign victims. Research by Claudio Guarnieri and Collin Anderson elaborated more on the Iranian attribution. The threat group compromised two news websites related to Jundallah as early as 2010, and exploited ActiveX vulnerabilities to attack the websites’ visitors. Prince of Persia seemed to have operated heavily around the 2013 Iranian Presidential elections, targeting Persian press members (such as BBC Persian), and resumed attacking civil society members and activists afterwards. Guarnieri & Anderson also observed that after the takedown by Palo Alto Networks, the Telecommunication Company of Iran blocked and redirected any traffic originating from Iran aimed at Palo Alto’s sinkholes. This was probably a deliberate attempt by the threat actors to reduce visibility and regain control of the victims. This was not an ability demonstrated by most threat actors, which further supports the connection to the Iranian government. In August 2017, Prince of Persia activity was observed again, this time through the use of a new malware dubbed Foudre, which means “lightning” in French. In 2018, Foudre version 8 introduced a new malware variant dubbed Tonnerre, which means “thunder” in French. The two variants worked together, with Foudre serving as the first-stage malware that was used to map a victim’s identity. If the victim was deemed important enough, Foudre then downloaded and executed Tonnerre.  As of 2022, the last known public version of Foudre was v24. The last known public version of Tonnerre was v11; however, we were able to download v14 and v15 from one of the C2 servers in 2022. https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 3 of 32 After that, Prince of Persia appeared to go dark, with no publicly identified activity over the next three years. Based on our in-depth understanding of this threat actor, we assumed they were still carrying out attacks under the radar, so we continued to actively hunt for evidence. In order to achieve this kind of monitoring over the course of several years, we established anchors and defined patterns that would help us find a new lead, even if the threat actor changed tactics, like using a new trojan version or C2 server structure. This tracking allowed us to maintain visibility into their malicious activity and develop the research updates presented in this post. The graphic below provides an overview of the timeline of the malware development process since 2016, including capture dates. The focus of this blog will be to elaborate on the new findings, which are identified in bold. https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 4 of 32 The Research Process As noted above, SafeBreach Labs has followed the Prince of Persia group since 2019. After the group appeared to go dark in 2022, our research team continued to hunt for evidence based on a variety of anchors and patterns we had defined. As a result, we were able to maintain unprecedented visibility into their malicious activity. Below, we provide an analysis of these findings.  Analysis of the Malware Files Foudre v34  With the new version of Foudre we discovered, the attack vector had changed from a macro file to a Microsoft Excel file with an embedded executable. The Excel file is fully undetectable by all antivirus engines in VirusTotal. Below is an image of the embedded executable header: https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 5 of 32 The Excel file drops Foudre v34 as an SFX file: Conf8830.dll is the loader.It will call the exported function f8qb1355 of d232, which is a Foudre v34 DLL and a camouflage MP4 file in order to complete the user deception (the icon is of windows media player). The SFX additional attack was uploaded from the US in March 2025: The threat actor also continues to use Excel files that include a macro as an attack vector (52e3a856548825ec0a3d6630e881ff4f79d2a11bc3420a73d42e161fabed53d9). The Excel file was included in a zip file named شاخص شهدای.zip (Notable Martyrs.zip)— alongside three other benign Excel files—and was uploaded to VirusTotal.com in January 2024 from Germany. https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 6 of 32 The Excel file includes macro code to drop and execute ccupdate.tmp. The threat actor left previous names of embedded Foudre files as comments: ccupdate.tmp is the current dropped file EZUpdate.tmp is known to be a Foudre v21 infection from 2020  euupdate.tmp and cqupdate.tmp infections are not publicly available Once the victim opens the excel file and is allowed to open ccupdate.tmp, Foudre is installed. https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 7 of 32 One of the samples includes an embedded deceptive message that was taken after May 2023 from this article. The main difference from previous versions is that a new DGA algorithm and DGA prefix LOS1are used. In addition, the algorithm is divided into two steps: https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 8 of 32 The first calculates the original DGA by computing a CRC32 of the string LOS1{}{}{}.format(date.year, date.month, weeknumber). The second DGA phase generates an eight character domain host name (only alphabet letters) by adding the value 0x8 and character index to any alphabet character and 0x39 to each digit. This is done in order to transform each a-f and 0-9 characters into characters.  This DGA generates domain names that consist of only characters from the range  j-z. This script implements the DGA: https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 9 of 32 An Internet check is also done to another legitimate site (see the appendix for additional details). Tonnerre v17 Tonnerre v17 is the latest version binary that we were able to capture at the time of publishing. This version uses the same DGA algorithm as Foudre v34 but with a different key prefix: FTS1. It includes an embedded news article that was published on January 20, 2023. https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 10 of 32 The file was built by the adversary a day after the article was published. We achieved access to it via direct download from the C2 server by impersonating a Foudre-infected file. After decrypting the SFX file, we obtained the final Tonnerre 17 binary.  Since January 2023, we have attempted to capture newer versions of Tonnerre. It took almost three years to find a new C2 server that could communicate with this newer Tonnerre version. We will explore this in more depth later, but first let’s understand the C2 structure of Foudre v34 and Tonnerre v17.  C2 Server Structures https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/ Page 11 of 32 Foudre v34 The C2 server structure of Foudre v34 included four directories: 1, 2, de, en. Below is an illustration of the C2 structure. NOTE: The real C2 server runs on Linux and does not enable directory browsing. Foudre sends the victim machine’s globally unique identifier (GUID) to the C2 server via a HTTP GET request: https:///1/?c=&u=&v=&s=&f=&mi=&b=&t=