Iranian Nation-State Group Hosts C2 Servers in the US

• •Prince of Persia is using U.S.-based C2 servers for the first time in over a decade.
• •The group employs advanced malware like Tornado to evade detection and maintain operations.
• •Organizations are advised to update security measures and monitor for unusual activity.

Semperis researchers discovered that the Iranian cyber threat group known as Prince of Persia is operating command-and-control (C2) servers in the U.S. for the first time in over a decade. This group, which has been active for nearly 20 years, primarily targets Iranian dissidents and organizations in the U.S., Europe, and the Middle East. The new C2 infrastructure was identified in August 2026, coinciding with a period of geopolitical conflict involving Iran. The group has shifted its tactics, utilizing shared hosting and advanced malware such as Foudre, Tonnerre, and Tornado to evade detection. The Tornado malware is particularly notable for its ability to blend in with legitimate traffic using the Telegram API. Recommendations for organizations include updating security controls and monitoring for unusual Telegram traffic. The shift back to U.S. hosting is significant given the group's previous reliance on European servers.