Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Iran's government-sponsored Prince of Persia APT group hosted a command-and-control server in the United States this year, marking its first such operation in the US since 2016.
The APT actor, also tracked as Infy, has operated for nearly two decades, primarily targeting Iranian dissidents and government and private entities in the US, Europe, and the Middle East. After a months-long lull in operations, the group resumed activity on May 27 with a new C&C server, quickly stealing over 1,800 files from a single victim using their Tonnerre malware family.
New Tactics
In August, security researcher Tomer Bar identified a new server supporting the second stage of Tornado, the group's latest malware. This server was located in the US, the first time since 2016 that Prince of Persia has hosted a C&C server inside the country. The attackers switched providers and abandoned virtual private servers in favor of Namecheap shared hosting.
This is the last place we expected to find Prince of Persia hiding.
Response
On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare, suggesting they had realized their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia's infrastructure and advises organizations to add them to their security tools while watching for suspicious Telegram traffic.
Related
