Iranian ‘Prince of Persia’ Threat Group Shifts Tactics to US-Based Infrastructure

In a development that has surprised cybersecurity analysts, an Iranian nation-state threat actor known as "Prince of Persia" has been observed leveraging command-and-control (C2) servers located within the United States to facilitate its long-running cyber-espionage operations. This tactical pivot marks a significant shift for a group that has maintained a consistent, albeit shadowy, presence in the global threat landscape for nearly two decades.

The discovery was detailed in a report published on October 22 by researchers at the cybersecurity firm Semperis. The investigation into Prince of Persia, a group known for its persistent targeting of government, public, and private sector organizations, has shed new light on the evolving sophistication of state-sponsored cyber warfare. By embedding their malicious infrastructure within the borders of their primary geopolitical adversary, the attackers have effectively challenged conventional wisdom regarding the geographic footprint of Iranian threat actors.

A Two-Decade Legacy of Espionage

The Prince of Persia group is far from a newcomer to the digital battlefield. For roughly 20 years, the entity has conducted targeted campaigns against a diverse range of victims, including organizations in the United States, Europe, and throughout the Middle East. Beyond corporate and governmental interests, the group is also known for its focus on political dissidents and individuals considered to be in opposition to the Iranian regime. This broad scope of activity—ranging from industrial espionage to the tracking of political enemies—underscores the group’s strategic importance to its state sponsors.

The threat posed by Prince of Persia is rooted in its highly intrusive data exfiltration capabilities. Unlike opportunistic cybercriminals who might focus on ransomware for financial gain, Prince of Persia operates with a focus on deep-level surveillance. The malware deployed by the group is designed to remain resident on a victim’s system for extended periods, granting the attackers the ability to harvest sensitive documents, capture screenshots in real-time, and even trigger the device’s microphone to record audio. This level of access transforms infected endpoints into persistent listening posts, providing the threat actors with continuous intelligence from within the target’s internal network.

Evolving Toolsets: From Foudre to Tornado

The technical sophistication of the group’s operations is evidenced by its tiered malware architecture. Researchers have identified a progression of tools that allow the group to maintain its foothold while minimizing the risk of detection. The current campaign utilizes a multi-stage infection process, beginning with a loader known as "Foudre." This initial component acts as the bridgehead, establishing the initial connection to the adversary’s C2 servers and preparing the environment for more advanced payloads.

Once the initial access is secured, the group deploys "Tonnerre," a second-stage malware that serves as the primary engine for espionage. Tonnerre provides the operators with comprehensive surveillance capabilities, allowing for the deep data exfiltration that has become the hallmark of the group’s operations.

Perhaps most concerning to security analysts is the introduction of a newer, more resilient tool identified as "Tornado." This malware represents an evolution of the group’s previous codebase, incorporating sophisticated evasion techniques designed to bypass modern network defenses. Tornado distinguishes itself by its ability to utilize both HTTPS and the Telegram API as covert channels for command-and-control communications. By leveraging the Telegram API, the malware masks its outbound traffic as legitimate communications with a widely used, reputable service. This "blending in" strategy allows the malware to slip past firewalls and intrusion detection systems that might otherwise flag unusual or unauthorized outbound connections.

Navigating Anti-Detection and Geopolitical Shifts

For years, Prince of Persia relied on a network of hosting services and virtual private servers (VPS) located throughout Europe to mask its activities. These regions offered a degree of operational security, allowing the group to rotate its infrastructure and avoid attribution. However, the recent shift toward US-based hosting providers represents a bold departure from this established pattern.

The discovery of this infrastructure was not a straightforward process, as the group’s anti-detection capabilities had initially obscured the hosting origin of the latest campaign. According to Tomer Bar, AVP of security research at Semperis, the group’s activity had experienced a noticeable decline earlier this year. In February, Prince of Persia appeared to "go dark," a lull that coincided with a period of heightened geopolitical tension, including strikes involving US and Israeli forces against Iranian targets.

"This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group," Bar noted, explaining that such pauses in activity are frequently observed as state-sponsored actors adjust their posture in response to real-world diplomatic or military developments.

However, when the group resumed its activity, researchers were able to track the signals emitted by the Tornado malware. The technical trail ultimately led them to a US-based hosting company. While it is common for threat actors to occasionally hide their activity within US borders—a tactic often used to exploit the sheer volume of legitimate traffic hosted there—the fact that an Iranian nation-state actor has chosen to do so is highly significant. According to historical analysis, it has been at least 12 years since an Iranian threat group was confirmed to be utilizing domestic US servers for its C2 operations. For the researchers at Semperis, the discovery was a stark reminder that even well-monitored environments can be used as staging grounds for sophisticated espionage. "This is the last place we expected to find Prince of Persia hiding," Bar added.

A Persistent Threat to Global Networks

The nature of Prince of Persia’s operations—highly targeted and low-profile—contrasts sharply with the "loud" nature of ransomware gangs or hacktivist groups. Because they prioritize longevity and intelligence gathering over immediate, visible impact, their presence on a network can often go unnoticed for months or even years. This "low and slow" approach makes the discovery of their infrastructure in the US particularly alarming, as it suggests an increased level of confidence and a desire to remain close to their primary targets.

While the group does not appear to be engaging in widespread, indiscriminate attacks, their persistence and the continued refinement of their malware tools present a significant challenge for security teams. The ability to pivot infrastructure to a major Western jurisdiction underscores the adaptability of state-sponsored actors, who are constantly iterating on their tactics, techniques, and procedures (TTPs) to stay one step ahead of defensive measures.

The cybersecurity community remains focused on analyzing the specific indicators of compromise associated with the latest Prince of Persia campaign. As organizations continue to bolster their defenses, the revelation that such an established threat actor has moved its C2 operations to US-based hosting highlights the need for a more nuanced approach to threat intelligence—one that does not rely on outdated assumptions about where "enemy" infrastructure can be located. As long as these groups maintain their focus on sensitive data and high-value targets, the battle between stealthy espionage tools like Tornado and the defenders attempting to detect them will continue to be a defining feature of the modern digital landscape.