AI Detects Dormant APTs: Prince of Persia Returns

A threat group can go “quiet” for years and still be operational. That’s the uncomfortable lesson from Iran’s “Prince of Persia” (also tracked as Infy), an advanced persistent threat (APT) whose activity traces back to 2004 and yet has continued targeting dissidents and other individuals across multiple regions.

Most security programs are built around what’s loud: fresh indicators, active ransomware crews, the latest phishing kit. But state-aligned espionage teams don’t need to be noisy. They need to be patient, careful, and persistent—exactly the profile that causes traditional detection and attribution to drift.

This post uses Prince of Persia as a case study for a bigger theme in our AI in Defense & National Security series: AI-driven threat detection and automated threat intelligence are now essential to spotting dormant APT activity, connecting it to known tradecraft, and responding before “silent” becomes “successful.”

Why “dormant APT” is a dangerous myth

A dormant APT usually isn’t dormant—it’s just operating below your visibility threshold. That threshold is often defined by signature-based detection, sporadic threat hunting cycles, and siloed telemetry.

Prince of Persia is a clean example. Public reporting on the group thinned out for years. Meanwhile, researchers now assess the actor has remained active, focusing heavily on surveillance of Iranian citizens and also reaching into Iraq, Turkey, India, Europe, and Canada. The takeaway isn’t “this one group is clever.” The takeaway is that time favors the attacker when defenders treat “no news” as “no activity.”

Here’s what I’ve found in real environments: once a group has stable infrastructure habits—preferred tooling patterns, operational security routines, targeting preferences—it can keep working with minor upgrades and still slip past defenses that are overly dependent on known indicators.

What makes long-running espionage campaigns hard to catch

Long-lived nation-state campaigns optimize for survivability, not speed. That shows up in three ways:

• Low-and-slow execution: fewer alerts, less correlation pressure.
• Selective targeting: “triage malware” filters victims, reducing exposure.
• Resilient command-and-control (C2): fewer static domains, more verification, more indirection.

AI becomes relevant here because defenders can’t manually “remember” twenty years of faint signals across endpoints, email, DNS, proxies, identity logs, and external intelligence. Machines can.

Prince of Persia’s playbook: triage first, espionage second

Prince of Persia’s tooling reflects a mature, disciplined workflow: identify who matters, then invest in deeper collection. SafeBreach reporting highlights two primary malware families associated with the group: Foudre (lightweight first stage) and Tonnerre (heavier espionage capability).

Foudre’s role is practical: collect basic system info, report back, and help the operator decide whether the target is worth continued effort. Researchers observed behavior consistent with victim sorting—some hosts were escalated to more involved spying, while others received a self-destruct command.

Tonnerre is the more capable payload for sustained surveillance. And it’s not just the payload that matters. What stands out is how the group protects the communications layer—the part defenders often target for disruption.

Telegram as C2: common tactic, uncommon operational security

Using legitimate platforms for C2 isn’t rare; hiding the “how” is where this group differentiates. Many threat actors that use Telegram for command-and-control embed an API key directly in malware code. That leaves artifacts defenders can extract.

In the reported activity, Tonnerre can use Telegram’s API in a way that avoids leaving that easy trail: instead of embedding a key, it retrieves it only under specific conditions and for specific victims. That reduces what reverse engineers can harvest from a single sample and makes “one-and-done” analysis far less effective.

A blunt way to say it: they’re designing the campaign so defenders can’t easily reuse their own forensic work.

RSA verification for C2 trust: why this hurts defenders

Foudre’s C2 design treats the attacker like a software publisher and the C2 response like a signed update. The malware carries a public key, generates large sets of candidate domains on a schedule using a domain generation algorithm (DGA), then checks whether the server it reaches can prove authenticity via RSA signature verification.

If the signature check fails, the malware doesn’t “phone home.” It moves on.

This matters because one classic defense move against DGAs is pre-registration or sinkholing. But when the malware won’t trust your server without the attacker’s private key, you can’t easily:

• intercept and analyze traffic at scale,
• disrupt the campaign by domain takeover,
• retrieve command patterns for detection engineering.

It’s a defensive nightmare because the control point isn’t the domain—it’s the cryptographic trust.

Snippet-worthy reality: When malware verifies C2 with attacker-held private keys, takedown becomes a cryptography problem, not a domain problem.

What this case says about state support (and why it changes your risk model)

State-aligned actors can get help that ordinary cybercriminals can’t. Earlier public actions against Prince of Persia included sinkholing efforts that disrupted the campaign. Reporting indicates that the group recovered with support that included network-level interference to redirect traffic away from defenders’ infrastructure.

For organizations in defense, public sector, NGOs, media, higher ed, or any environment that intersects with geopolitical conflict, the risk model needs to assume:

• Infrastructure resilience: campaigns can survive takedown attempts.
• Long memory: operators learn from disruption events and harden.
• Multi-jurisdiction targeting: victims can be outside the actor’s region.

That’s the bridge to our series theme: AI in defense and national security isn’t only about detecting malware; it’s about maintaining strategic visibility into threat actors who can operate for years.

Where AI actually helps: detecting “quiet” APT activity

AI’s most useful job here is correlation: connecting weak signals into a strong story. The Prince of Persia campaign contains multiple elements that are individually explainable, but collectively suspicious.

A practical AI-assisted detection strategy focuses on behaviors, not static indicators:

• Execution chains: Office document → dropped executable → unusual child processes → staged reconnaissance.
• Selective persistence: activity spikes on a subset of hosts after “triage.”
• C2 patterns: repeated DNS lookups consistent with a DGA, followed by limited successful connections.
• Data movement: low-volume but regular exfiltration; use of legitimate APIs.

Behavioral analytics that fit this case

If you want AI to surface dormant APTs, you need models trained on sequences, not single events. The most effective patterns to model include:

1. Kill chain transitions (e.g., initial access → discovery → credential access → collection).
2. Time-based anomalies (e.g., weekly DGA-like resolution behavior).
3. Cross-host consistency (shared tactics across endpoints that don’t share the same software stack).
4. Identity + endpoint coupling (the same user identity accessing mailboxes while the endpoint runs discovery tooling).

This is where modern security analytics (including graph-based approaches and transformer-style sequence modeling) can outperform manual hunting. Humans are great at intuition once the shape of the campaign is visible. AI is what makes the shape visible.

AI-assisted attribution: “who is this like?”

Attribution is a pattern-matching problem under uncertainty. It’s not solved by a single indicator; it’s solved by aligning many small observations with known tradecraft.

AI helps by scoring similarity across:

• malware family evolution (shared code traits, configs, encryption routines),
• infrastructure style (domain naming cadence, hosting preferences, TLS fingerprints),
• operator workflows (triage tools that self-destruct, victim filtering),
• target sets (dissidents, diaspora communities, region-specific overlaps).

A strong automated threat intelligence pipeline doesn’t just tell you “malware found.” It tells you: this looks like X, and here’s why, with confidence scores and supporting evidence.

What security teams should do next (actionable, not aspirational)

The goal isn’t to “catch Prince of Persia.” The goal is to design a program that catches the next quiet APT even when it rebrands, upgrades, or goes low.

1) Treat triage malware as a high-severity signal

Lightweight reconnaissance payloads are often dismissed because they don’t immediately encrypt files or spawn obvious persistence mechanisms. Don’t do that.

Operationally, triage tooling means: you’ve been shortlisted. Escalate fast.

• Quarantine the host and preserve volatile evidence.
• Review the user’s mailbox rules and OAuth grants.
• Hunt laterally for similar execution chains.

2) Instrument for sequence detection (not just IOCs)

If your SIEM and EDR detections are mostly indicator lists, you’re set up to miss cryptographically protected C2.

Prioritize detections that look like:

• Office-origin execution followed by reconnaissance commands,
• unusual scheduled tasks or registry changes after an initial beacon,
• recurring DNS resolution bursts with low connection success rates.

3) Add AI-supported threat hunting “cadence,” not “projects”

Dormant APTs punish quarterly hunting. Build a cadence:

• weekly automated anomaly review,
• monthly hypothesis-driven hunts,
• continuous model tuning based on new intel.

If you’re doing this manually with spreadsheets, you’re leaving value on the table.

4) Plan for platform abuse (Telegram and beyond)

Blocking a single app rarely solves the problem. What works better:

• enforce least-privilege egress policies,
• monitor unusual API usage patterns,
• baseline “normal” sanctioned SaaS traffic and alert on drift.

5) Make attribution operationally useful

Attribution shouldn’t be a slide deck; it should change what you do.

• If a cluster looks state-aligned, increase incident severity.
• Expand scope to identity, mobile, and personal accounts where policy allows.
• Coordinate with legal, HR, and physical security when targeting suggests surveillance of individuals.

The bigger point for AI in Defense & National Security

Prince of Persia is still alive because the campaign design assumes defenders will lose continuity: staff turns over, detections age out, and attention shifts to the next crisis. That’s a realistic assumption—and it works.

AI flips that dynamic when it’s used to preserve organizational memory: behaviors, timelines, relationships, and weak signals that add up. The win isn’t “perfect prevention.” The win is earlier recognition and faster containment, even when the actor is quiet, patient, and cryptographically careful.

If you’re building a 2026 security roadmap right now, here’s the question worth sitting with: what would it take for your team to spot a 2004-era threat actor operating in 2025—and to prove it quickly enough that leadership takes action?