Telegram for the throne.

SafeBreach Labs' deep-dive into the Iranian-linked APT "Prince of Persia" finds the group remained active beyond 2022, uncovering new Foudre and Tonnerre malware variants, expanded campaign scale, active C2 infrastructure into late 2025, and a shift to Telegram-based command-and-control, providing sustained visibility and fresh IOCs into the group's evolving tooling and targeting.