CP
cyberpings
Threat IntelHIGH

Iranian APT Prince of Persia Evolves with New Malware Tactics

CWCyberWire Daily
IranAPTPrince of PersiamalwareSafeBreach
🎯

Basically, a group of hackers linked to Iran has updated their methods and tools for cyber attacks.

Quick Summary

A new study reveals that the Iranian APT group, Prince of Persia, is still active and evolving. They’ve updated their malware and tactics, posing risks to online security. Cybersecurity experts are monitoring these developments closely to help protect users and organizations.

What Happened

Cybersecurity experts have recently uncovered that the Iranian nation-state APT group known as Prince of Persia is still active and evolving. This revelation comes from a detailed study led by Tomer Bar at SafeBreach Labs. Contrary to earlier beliefs that the group had gone dark after 2022, researchers found that they have actually adapted their strategies and tools.

The investigation highlights the emergence of new variants of Foudre and Tonnerre malware, which are key tools used by this group. Additionally, the research indicates that the group has expanded its campaign scale and maintains active command-and-control (C2) infrastructure, expected to persist through late 2025. A notable shift in their operations has been the use of Telegram for command-and-control, which enhances their ability to communicate and coordinate attacks.

Why Should You Care

You might think that state-sponsored hacking is a distant issue, but it directly impacts your digital life. If you use online services or apps, the tactics employed by groups like Prince of Persia could eventually affect you. Imagine if a hacker group could manipulate your favorite app or even your bank's online services — that’s the kind of threat we’re talking about.

The key takeaway is that nation-state actors are continuously refining their tactics, making it essential for everyone to stay informed about the evolving cyber threat landscape. This isn’t just a problem for governments; it’s a problem for all internet users. As these groups become more sophisticated, your personal data and online security are at greater risk.

What's Being Done

The cybersecurity community is actively monitoring the activities of the Prince of Persia group. SafeBreach Labs has provided critical insights into their operations, which can help organizations bolster their defenses. Here’s what you can do right now:

  • Stay updated on the latest cybersecurity news and threats.
  • Ensure your software and systems are regularly updated to protect against known vulnerabilities.
  • Use strong, unique passwords and consider multi-factor authentication for added security.

Experts are closely watching for further developments in the group’s tactics and any new malware variants that may emerge. The ongoing research will help shape defensive strategies against these evolving threats.

🔒 Pro insight: The shift to Telegram for C2 indicates an adaptation to evade traditional detection methods, raising the stakes for threat intelligence.

Original article from

CyberWire Daily

Read Full Article

Share

Related Pings

HIGHThreat Intel

DDoS Attacks - Major Blow Against International Cybercriminals

In a major crackdown, authorities have dismantled two large DDoS botnets, Aisuru and Kimwolf. These networks posed serious threats to online services, impacting users worldwide. While progress has been made, the risk remains as key actors evade capture. Ongoing vigilance is essential in combating cybercrime.

CSO Online·
HIGHThreat Intel

Threat Intel - Authorities Disrupt Major IoT Botnets

Authorities have disrupted four IoT botnets behind record DDoS attacks. Millions of devices were targeted, leading to significant financial losses for victims. This operation highlights the urgent need for improved cybersecurity measures.

Help Net Security·
HIGHThreat Intel

Threat Intel - Global Law Enforcement Disrupts Major Botnets

A major law enforcement operation has disrupted IoT botnets like AISURU and Kimwolf. Millions of devices were impacted, showcasing the global effort to combat cybercrime. This crackdown aims to reduce the frequency of DDoS attacks and protect victims worldwide.

Security Affairs·
HIGHThreat Intel

Cybercrime Threat - Teens Being Radicalized Online

The NCA warns of a troubling trend: teens are being radicalized into cybercrime through online platforms. This shift is blurring crime boundaries and poses serious risks. Law enforcement is adapting, but the challenge remains significant.

Infosecurity Magazine·
HIGHThreat Intel

Threat Intel - Espionage Reality in Your Infrastructure

Recent espionage activities reveal that enterprises are now within the collection path of threat actors. This shared infrastructure vulnerability poses significant risks. Organizations must adapt their security strategies to mitigate these threats effectively.

CSO Online·
HIGHThreat Intel

Russian APT - Exploits Zimbra XSS Targeting Ukraine Agency

A Russian APT has exploited a Zimbra vulnerability to target a Ukrainian government agency. This attack highlights the sophisticated tactics used by state-sponsored actors. Immediate action is needed to secure vulnerable systems and protect sensitive data.

Cyber Security News·