Iranian Nation-State APT Targeting Networks and Critical Infrastructure Organizations

Iranian state-sponsored APT "Prince of Persia" has reemerged with a global cyberespionage campaign targeting critical infrastructure and private networks using updated Foudre v34 and Tonnerre v50 backdoors delivered via malicious Excel files; technical analysis highlights loader DLL Conf8830.dll (export f8qb1355), a masqueraded DLL named d232, a two-phase DGA for C2 hostnames, and a Telegram-based command channel enabling persistent, selective control and data exfiltration.