"This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group,” said Tomer Bar, AVP of security research at Semperis.
Prince of Persia: a two-decade persistent actor and its targets
Semperis researchers on October 22 reported that an Iranian nation-state cyber threat group known as “Prince of Persia” has been active for around two decades. According to the report, the group targets both public and private sector organisations across the US, Europe and the Middle East, as well as dissidents and others opposed to the Iranian regime. The activity is described as highly targeted rather than widespread but persistent over time.
Tornado, Foudre and Tonnerre: the malware toolkit
Semperis identified multiple malware families used in the latest Prince of Persia campaign. Foudre is described as a first-stage malware loader. Tonnerre is a second-stage malware that researchers say provides attackers with “full surveillance capabilities,” including intrusive data exfiltration, screenshot capture and audio recording from infected devices. A more recently identified component, Tornado, builds on the codebase of previous malware and adds operational flexibility: Tornado can use both HTTPS and the Telegram API as a covert command-and-control (C2) channel, allowing it to blend with legitimate network traffic and evade detection and perimeter controls.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildUS-hosted C2 infrastructure: an unexpected location
Information contained in the Tornado malware enabled Semperis to identify where the campaign was being hosted: a US hosting company. While the use of US hosting providers by threat actors is not unheard of, Semperis writes this is the first time an Iranian threat group has been identified as hosting its activity on US servers in at least 12 years. Tomer Bar told Semperis researchers that Prince of Persia “seemed to go dark in February this year, coinciding with US and Israeli strikes against Iran,” a pattern the team said is not unusual for the group given its geopolitical context.
Anti-detection techniques and research breakthrough
Semperis notes Prince of Persia has a history of hiding activity on European hosting services and virtual private servers while relying on anti-detection capabilities that initially made it difficult for researchers to locate the current campaign’s infrastructure. The breakthrough came when artifacts in the Tornado malware revealed hosting details, allowing Semperis to trace the C2 infrastructure to the US-based provider. The report highlights how incremental changes in malware code — and the re-use of components — created the evidence chain that exposed the campaign’s operational footprint.
What this means for technologists, procurement leaders, and affected organisations
- Technologists and security teams: Semperis recommends ensuring security controls are up to date and that operating systems are fully updated. Given Tornado’s use of HTTPS and the Telegram API for covert C2, monitoring for unusual Telegram traffic is also advised.
- Procurement and hosting providers: The discovery raises questions about how adversary activity can be routed through commercial hosting in one country while the actor originates elsewhere; providers should be prepared to investigate abuse reports and to work with incident responders when code artifacts identify malicious activity.
- Affected enterprises and dissidents: Organisations and individuals named as targets should review detection capabilities for data exfiltration, screenshots and audio capture, and prioritize patching and endpoint controls in line with the Semperis recommendations.
The Semperis findings offer a narrow but clear lesson: even sophisticated anti-detection measures can be undone by reusable code and operational artifacts. In this case, a recently observed malware variant — Tornado — both extended prior capabilities and left the traces that led researchers to a US-based host. Semperis’s recommended mitigations are practical and specific: update security controls, monitor for unusual Telegram traffic, and keep operating systems current.
The report leaves a concrete, investigable next step: whether the hosting provider has taken action and how routing through US infrastructure affected the campaign’s operational security. For now, defenders have a technical lead to follow — a set of malware families and a hosting footprint — and a short, pragmatic checklist from Semperis to reduce exposure.
Original story: https://www.infosecurity-magazine.com/news/iranian-hacking-group-hosting-c2/
