Iranian Nation-State Group Hosts C2 Infrastructure in the US

• •Iranian threat group Prince of Persia is operating a C2 server in the U.S.
• •The group targets Iranian dissidents and uses advanced malware for surveillance.
• •Semperis recommends updating security controls and monitoring Telegram traffic.

Semperis has identified the Iranian nation-state threat group known as Prince of Persia operating a command-and-control (C2) server in the United States for the first time in a decade. This discovery was made by Tomer Bar, AVP of Security Research at Semperis, who has tracked the group for ten years. The group had previously relied on European hosting but shifted its operations back to the U.S. after going dark in February 2026, coinciding with the onset of conflict between Iran, the U.S., and Israel. Recent victims of this group include Iranian dissidents, and the group employs advanced techniques such as using Telegram API channels and domain-generation algorithms to maintain its infrastructure. The malware used in these campaigns includes Foudre, Tonnerre, and Tornado, which provide extensive surveillance capabilities. Semperis recommends organizations update their security controls and monitor for unusual Telegram traffic to mitigate risks associated with this threat.