Prince of Persia Iran Group Hid C2 Server in US

Security teams have a fresh set of indicators to check for Prince of Persia, one of the longest-running Iranian espionage groups, after researchers found it running a command-and-control (C2) server in the United States. Semperis, an identity security company, published the indicators of compromise (IOCs) on 22 October alongside a technical write-up by Tomer Bar, its vice-president of security research.

The defensive advice is short: update security controls with the published IOCs, watch for unusual Telegram traffic, and keep operating systems fully patched. The bigger finding is where the group chose to hide. According to Semperis, “for the first time in a decade, the Iranian threat actor decided to host its new C2 server on US soil”.

In brief

Semperis says Prince of Persia moved a C2 server to US shared hosting, a first for the group in a decade, and has published IOCs.
Its advice to defenders: block the IOCs, monitor unusual Telegram traffic and keep systems fully updated.
Victim numbers appear low, and Semperis has not named the victim it observed.

Three steps Semperis wants defenders to take

Semperis says it is publishing the indicators to blunt the group’s operations. “We believe that by publicly sharing this analysis and our observed indicators of compromise (IOCs), we can reduce the impact of this cyber threat,” the blog says. The list in the post covers server addresses, hosting providers and domains for all three of the group’s known malware families.

Its recommendations, repeated in the company’s press release, are: “Ensure that your security controls are updated to protect against the IOCs provided in this post. Monitor for any unusual Telegram traffic. Ensure that your operating systems are fully updated.”

The Telegram point matters because of how the group’s newest malware talks home. Tornado, which SafeBreach researchers documented in February, “uses both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate network traffic to bypass firewalls”, Semperis writes. It says Tornado is dropped “via one-day software vulnerabilities (e.g., WinRAR exploits)”, which is why the patching step is on the list.

A long-running group that targets dissidents

Prince of Persia was first reported publicly in 2016 by Palo Alto Networks’ Unit 42. Semperis describes it as active “for nearly two decades”, “primarily attacking Iranian dissidents and public and private sector organizations in the United States, Europe, and the Middle East”. Its earlier campaigns around Iran’s 2013 presidential election “targeted the press, including BBC Persian”, according to the blog.

Its toolkit has grown over time, from the Infy malware to a first-stage tool called Foudre, a surveillance tool called Tonnerre, and Tornado. Bar has followed it across two employers. At SafeBreach, he reported in February that the group had replaced its Telegram account and C2 servers, and that it paused its servers during Iran’s internet shutdown in January.

The release says “Recent victims are primarily Iranian dissidents.” In one case Semperis watched, Tonnerre “exfiltrated more than 1,800 files” from a single victim in its first week. Semperis has masked that victim’s details “due to privacy concerns”. It also says “The number of victims remains low, which could indicate either targeted attacks or difficulties infecting new victims.”

From European servers to US shared hosting

According to Semperis, the group “previously relied on European hosting and virtual private servers”. Its second-stage C2 server vanished in September 2025. Bar’s team found it again in August 2026, at a US address that it says was “probably first built on July 7, 2026”.

The new server sat on Namecheap shared hosting, “which hosts thousands of independent domains”, next to ordinary sites and others run by unrelated criminals. The group had also swapped its server-management software for cPanel. Then, on 24 August, it began building another server behind Cloudflare’s network. Semperis suspects “the threat actor probably realized that its newest C2 server had been discovered.”

The timing ties into the war. Semperis says the group’s three-month downtime was “the longest downtime in nearly two decades of activity” and ended on 27 May. Bar’s own account of when it went quiet differs slightly between the two documents. In the release he says: “Prince of Persia went dark in February 2026 at the beginning of the conflict with the U.S. and Israel. This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group.” The blog says “Since March 2026, Prince of Persia has gone dark”.

“What surprised me this time, however, was the threat actor’s decision to host the new C2 server for the first time in 10 years on U.S. soil,” Bar said. “This is the last place we expected to find Prince of Persia hiding.”

Shared hosting makes attribution harder, and blocking easier

The move is less exotic than it sounds, and Semperis says so: “it is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor.” What changes is the defender’s problem. A server on a shared host or behind Cloudflare sits on addresses that thousands of innocent sites also use, so a crude block of the IP could break legitimate traffic, and a domestic address may look less suspicious to tools tuned for foreign hosting. That is why the domain and behaviour-based indicators, and the Telegram monitoring advice, carry more weight than any single address.

There is also a gap in the timing claim. Semperis says the US server appeared “at the same time as the beginning of the recent hostilities”, but its own data dates the server to about 7 July, more than four months after the strikes began on 28 February. The fair reading is that the group rebuilt during the conflict, rather than on its first day. The low victim count is a second reason for caution: this looks like targeted surveillance of a small group of people, most of them Iranian dissidents, not a broad campaign against companies.

For defenders, the most useful lesson is the speed of the cat-and-mouse game. The group rebuilt within days of SafeBreach’s February report and moved again within weeks of Semperis’s discovery. Published IOCs age quickly, which makes patching and traffic monitoring the durable parts of the advice.

State-linked groups have been busy this month. TSN has reported on ESET linking a wiper attack on a Ukrainian grain firm to two Russian groups and Kaspersky’s findings on Lazarus malware using post-quantum cryptography. Iranian operations have also surfaced in OpenAI’s disruption of two influence campaigns and X’s suspension of more than 13,000 accounts.

Semperis’s write-up includes no comment from Namecheap or Cloudflare. The next test is whether the Cloudflare-fronted server, which Semperis calls the last known Tornado C2 server, stays live now that its address is public.