Prince of Persia: A Threat Group Hiding in Plain Sight

The report

New research from Semperis reveals the Prince of Persia APT group’s latest activities, including new strategies and indicators of compromise.

Read the full analysis: Prince of Persia: A Threat Group Hiding in Plain Sight (Semperis).

Indicators

Malware C

• bymznpviesmqs[.]privatedns[.]org
• dxwwaaciuxyu[.]hbmc[.]net
• emcwoyqtplckl[.]privatedns[.]org
• hyccrukeryvr[.]hbmc[.]net
• ipsskhmcdpgd[.]hbmc[.]net
• izniiyloqqwcq[.]hbmc[.]net
• izwljrmohqwcq[.]privatedns[.]org
• jqkctsldgwkbw[.]privatedns[.]org
• kxzsfydnivzmv[.]privatedns[.]org
• mksrnosw[.]privatedns[.]org
• noornppw[.]space
• ouqqdplfgurg[.]hbmc[.]net
• ppnrvsst[.]space
• qmmnssws[.]privatedns[.]org
• qroosoqs[.]space
• trllpgwnarxa[.]hbmc[.]net
• twogtmbpkkfnk[.]hbmc[.]net

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#26). This page is generated from that record and the report’s own title and summary; nothing is rewritten.