Iranian nation-state actor changes hosting strategy, uses shared infrastructure and continues to evolve stealthy malware capabilities.
HOBOKEN, N.J., Oct. 22, 2026 /PRNewswire/ — Semperis, the identity-driven cyber resilience and crisis response company, today announced that Tomer Bar, AVP of Security Research, discovered that the Iranian nation-state-sponsored threat group Prince of Persia was operating a command-and-control (C2) server earlier this year in the U.S.. Bar has been tracking the group for 10 years and discovered the first two instances of Prince of Persia operating C2 servers in the U.S., first in 2016 and again this year. Recent victims are primarily Iranian dissidents.
The shift back to U.S. soil is notable because Prince of Persia had previously relied on European hosting and virtual private servers. The discovery of the new C2 server was made in August 2026. The threat group had gone dark after the Iranian war with the U.S. and Israel began on February 28. The group moved to shared hosting, changed its remote management panel and began building new infrastructure behind Cloudflare, effectively hiding its operations alongside benign websites and infrastructure used by other threat actors. The group uses Telegram API channels, domain-generation algorithms and blockchain-based exfiltration to maintain resilient C2 infrastructure.
“Prince of Persia went dark in February 2026 at the beginning of the conflict with the U.S. and Israel. This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group. What surprised me this time, however, was the threat actor’s decision to host the new C2 server for the first time in 10 years on U.S. soil, at the same time the conflict with the U.S. and Israel began,” said Bar. “This is the last place we expected to find Prince of Persia hiding.”
Recommendations for defenders
Organizations can take the following steps to protect their environment against techniques used by Prince of Persia:
- Ensure that security controls are updated to protect against the indicators of compromise (IOCs) provided in the research.
- Monitor for unusual Telegram traffic.
- Ensure that operating systems are fully updated.
The full research and associated IOCs are available at: https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/
About Semperis
Semperis is the identity-driven cyber resilience and crisis response company trusted by the world’s largest enterprises and government agencies to protect critical identity systems. Purpose-built for multi-cloud and hybrid identity environments—including Active Directory, Entra ID, Okta, and Ping Identity—Semperis helps organizations prevent, detect, respond to, and recover from identity-based cyberattacks.
Modern cyberattacks are won or lost at the identity layer, where failures now escalate into full-scale business crises. Semperis’ AI-powered platform unifies identity lifecycle defense and crisis management—hardening identity infrastructure, detecting and containing active threats, enabling rapid, trusted recovery, and supporting secure, out-of-band coordination when core systems are disrupted—all reinforced by a world-class identity forensics and incident response team.
As part of its mission to help organizations achieve true cyber resilience, Semperis supports the broader cyber community through the award-winning Hybrid Identity Protection (HIP) Conference and Podcast and free identity security tools including Purple Knight and Forest Druid. More than 1,200 organizations—including over 25% of the 100 largest U.S. companies—rely on Semperis. The company is privately held, headquartered in Hoboken, New Jersey, and serves customers in more than 40 countries.
Learn more: https://www.semperis.com
Follow us: Blog / LinkedIn / X / Facebook / YouTube
Media Contact:
Bill Keeler
Senior Director, PR & Comms
[email protected]
SOURCE Semperis
