Check for Iranian Threat Group Using US Servers for Malware Command and Control

Cybersecurity researchers at Semperis discovered that the Iranian threat group Prince of Persia is using command-and-control servers located in the United States to support its espionage campaigns. Published on October 22, the findings reveal that this long-active group has shifted its infrastructure strategy, operating on American soil rather than relying solely on European hosting services or virtual private servers.

Root cause

The group targets public and private sector organizations across the US, Europe, and the Middle East, as well as dissidents opposing the Iranian regime. Their malware provides intrusive data exfiltration capabilities, allowing attackers to steal sensitive documents, capture screenshots, and record audio from infected devices. The campaign involves multiple malware forms, including Foudre as a first-stage loader and Tonnerre for full surveillance.

Attack path

A newer malware variant called Tornado builds on previous codebases but introduces advanced evasion techniques. It uses both HTTPS and the Telegram API as covert command-and-control channels. This allows the malicious traffic to blend in with legitimate network activity, helping it bypass firewalls and evade detection. Researchers initially struggled to identify the hosting location due to these anti-detection capabilities.

Affected versions

• Public and private sector organizations in the US, Europe, and the Middle East.
• Dissidents and individuals opposed to the Iranian regime.
• Organizations previously targeted by Prince of Persia campaigns over the last two decades.

Mitigation

• Monitor network traffic for unusual HTTPS and Telegram API usage patterns.
• Inspect endpoints for signs of Foudre, Tonnerre, or Tornado malware families.
• Review server logs for connections to unexpected command-and-control infrastructure.
• Verify that security tools can detect malware blending with legitimate traffic.

For customers and users

Organizations should review their network logs for unexpected connections to external servers, particularly those using common protocols like HTTPS or messaging APIs. Check endpoint security logs for signs of unauthorized screen capture or audio recording tools. Users should remain vigilant against follow-up scams that exploit news of breaches to steal credentials. Verify all communications through official channels and avoid clicking links in unsolicited messages claiming to relate to security incidents.

What to do and how to stay safe: Prince of Persia

• Verify that your endpoint detection tools are updated to identify known malware families like Tornado.
• Monitor network logs for unusual outbound connections, especially those mimicking legitimate services.
• Ensure your firewall rules account for covert command-and-control channels using standard protocols.
• Review access logs for any unauthorized data exfiltration or surveillance activities on critical systems.

Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is the Prince of Persia threat group?

Prince of Persia is an Iranian nation-state cyber threat group that has been active for around two decades, targeting organizations and dissidents globally.

Why is the use of US servers significant?

It is the first time in at least 12 years that an Iranian threat group has been identified as hosting its activity on US servers, which researchers noted was unexpected.

What malware is used in this campaign?

The campaign uses Foudre as a loader, Tonnerre for surveillance, and Tornado, which uses HTTPS and Telegram API for covert command and control.