Iranian Spy Group 'Prince of Persia' Caught Running Attack Servers from US Hosting

Researchers at Semperis have found that an Iranian nation-state group known as Prince of Persia is using command-and-control (C2) servers based in the US to support its malware delivery and espionage campaigns. The findings were published on October 22. The group has been active for around two decades and targets public and private sector organisations in the US, Europe and the Middle East, as well as dissidents and others opposed to the Iranian regime.

The campaigns use several types of malware. Foudre is a first stage loader, and Tonnerre is a second stage tool that researchers say gives attackers full surveillance capabilities. A newer tool, Tornado, builds on earlier code. Together, the malware can steal sensitive documents, secretly take screenshots and capture audio from an infected device. Tornado can communicate over HTTPS and the Telegram API, which helps it blend in with normal network traffic and avoid firewalls and detection.

The group has previously hidden activity on European hosting services and virtual private servers. Its anti-detection features made the latest hosting hard to trace at first, but information inside Tornado let researchers locate a US hosting company. Semperis says this is the first time in at least 12 years that an Iranian group has been identified hosting activity on US servers. Tomer Bar of Semperis said the group appeared to go quiet in February, which he noted is not unusual during geopolitical conflict involving Iran. He added: "This is the last place we expected to find Prince of Persia hiding."