Two vendors, different telemetry, same shape: Iran’s hackers went dark with its internet

ESET Research published its APT Activity Report on 28 October, covering activity its analysts documented between April and September 2026. The firm reports that Iran-aligned groups — FilthyFeline, a subgroup of OilRig, and MuddyWater — resumed operations after a quieter period, with most activity directed at entities in Israel across multiple sectors and a smaller number of US companies affected. FilthyFeline also appears to have taken over operations against a cellular data service provider in Uzbekistan previously compromised by BladedFeline, another OilRig subgroup. ESET attributes the overall rise in Middle East-aligned activity mainly to the return of these established groups, and offers a causal explanation for the earlier decline: internet restrictions imposed by the Iranian regime, it says, hindered the groups' own ability to operate effectively. That is ESET’s assessment, not an established fact, and the firm does not publish the telemetry underlying it.

A second vendor arrives at the same shape from different data. Semperis, in research that cleared the wires between 22 and 28 October but rests on an August discovery, reports that the group it tracks as Prince of Persia — also known as Infy, active for nearly two decades against Iranian dissidents and against targets in the US, Europe and the Middle East — halted activity for roughly three months after the US-Israel war with Iran began on 28 February, resuming on 27 May with new infrastructure and renewed data theft. Tomer Bar, Semperis’s AVP of security research, says the group moved from virtual private servers to shared hosting inside the United States, its first US-based command-and-control infrastructure since 2016, later building further infrastructure behind Cloudflare. “This is the last place we expected to find Prince of Persia hiding,” Bar told Iran International. Bar has tracked the group for ten years and found both the 2016 and 2026 instances; the continuity is one analyst’s.

Assessment: The convergence is the finding, not either report alone. Two firms with different sensors place the same trough and the same recovery across February–May, which makes the blackout-degrades-the-attacker thesis harder to dismiss as vendor narrative. Distrust two things. First, nobody in this window has established Iran’s current connectivity state: the NetBlocks figures circulating — 240 hours in March, 57 days in April — describe the wartime blackout, not today, and “eased” is not “lifted.” Second, the Semperis timeline is single-analyst continuity. Note also the line every aggregator skipped: ESET found Arid Viper, a Hamas-affiliated actor, targeting what appears to be the Palestinian Authority’s own foreign ministry.