Semperis, an identity-driven cyber resilience and crisis response company, has revealed that the Iranian nation-state-sponsored threat group Prince of Persia established command-and-control (C2) infrastructure in the United States earlier this year.
The discovery was made by Tomer Bar, AVP of Security Research at Semperis, who has monitored the threat group for a decade. Bar previously identified Prince of Persia operating a U.S.-based C2 server in 2016, making the latest discovery the second known instance during his 10 years of tracking the group. Recent targets have primarily included Iranian dissidents.
The group’s return to U.S.-based infrastructure represents a departure from its previous reliance on European hosting providers and virtual private servers. Bar identified the latest C2 server in August 2026, following a period of inactivity that began when the conflict involving Iran, the United States and Israel started on February 28.
As part of its evolving operational strategy, Prince of Persia transitioned to shared hosting, modified its remote management panel and began deploying new infrastructure behind Cloudflare. This approach allows the group to conceal malicious activity among legitimate websites and infrastructure associated with other threat actors.
The group also employs Telegram API channels, domain-generation algorithms and blockchain-based exfiltration techniques to strengthen the resilience of its C2 infrastructure and maintain operational capabilities.
“Prince of Persia went dark in February 2026 at the beginning of the conflict with the U.S. and Israel. This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group. What surprised me this time, however, was the threat actor’s decision to host the new C2 server for the first time in 10 years on U.S. soil, at the same time the conflict with the U.S. and Israel began,” said Bar. “This is the last place we expected to find Prince of Persia hiding.”
The findings highlight how nation-state-sponsored threat actors continue to adapt their hosting strategies and malware capabilities to evade detection. By leveraging shared infrastructure and legitimate services, Prince of Persia has introduced additional challenges for defenders attempting to identify and disrupt its operations.
To reduce exposure to techniques associated with Prince of Persia, Semperis recommends that organizations:
- Update security controls to detect and protect against the indicators of compromise (IOCs) identified in the research.
- Monitor network activity for unusual Telegram traffic that could indicate malicious communications.
- Keep operating systems fully updated to reduce potential security vulnerabilities.
Additional technical findings and associated indicators of compromise are available in the full Semperis research.
____________
About Semperis
Semperis is the identity-driven cyber resilience and crisis response company trusted by the world’s largest enterprises and government agencies to protect critical identity systems. Purpose-built for multi-cloud and hybrid identity environments—including Active Directory, Entra ID, Okta, and Ping Identity—Semperis helps organizations prevent, detect, respond to, and recover from identity-based cyberattacks.
Modern cyberattacks are won or lost at the identity layer, where failures now escalate into full-scale business crises. Semperis’ AI-powered platform unifies identity lifecycle defense and crisis management—hardening identity infrastructure, detecting and containing active threats, enabling rapid, trusted recovery, and supporting secure, out-of-band coordination when core systems are disrupted—all reinforced by a world-class identity forensics and incident response team.
As part of its mission to help organizations achieve true cyber resilience, Semperis supports the broader cyber community through the award-winning Hybrid Identity Protection (HIP) Conference and Podcast and free identity security tools including Purple Knight and Forest Druid. More than 1,200 organizations—including over 25% of the 100 largest U.S. companies—rely on Semperis. The company is privately held, headquartered in Hoboken, New Jersey, and serves customers in more than 40 countries.
Join our LinkedIn group Information Security Community!
