Iranian hacker group hides C2 server in US for first time

Semperis has identified an Iranian state-backed threat group operating a command-and-control server in the United States. The group, known as Prince of Persia, has not previously been seen using US-based hosting in at least a decade.

The finding adds to scrutiny of Iranian cyber activity after Australia, New Zealand, the US and other governments condemned cyberattacks attributed to Iran. Australia's Cyber Security Centre has also warned that Iranian state-sponsored actors have compromised critical infrastructure through brute-force attacks, stolen credentials and the exploitation of known vulnerabilities.

The research is based on work by Tomer Bar, AVP of Security Research, who discovered the server in August. Prince of Persia has been active for nearly two decades and has mainly targeted Iranian dissidents, along with public and private sector organisations in the US, Europe and the Middle East.

According to the research, the group changed its hosting strategy after going dark following the start of the conflict involving Iran, the US and Israel in February. It had previously relied on European hosting and virtual private servers, but then shifted to shared hosting, changed its remote management panel and began building new infrastructure behind Cloudflare.

That change matters because shared hosting can make malicious activity harder to distinguish from legitimate traffic. By placing infrastructure alongside ordinary websites and services, threat groups can make detection more difficult for defenders monitoring for suspicious behaviour.

The group also uses Telegram API channels, domain-generation algorithms and blockchain-based exfiltration to maintain resilient command-and-control infrastructure. Those methods point to a broader pattern in which state-linked cyber groups rotate tools and hosting arrangements to avoid being blocked or taken down.

Shift in tactics

Bar said the move stood out because of where the infrastructure was hosted and when it appeared.

"Prince of Persia went dark in February 2026 at the beginning of the conflict with the U.S. and Israel. This isn't unusual given that geopolitical conflict involving Iran leads to downtime with the threat group. What surprised me this time, however, was the threat actor's decision to host the new C2 server for the first time in 10 years on U.S. soil, at the same time the conflict with the U.S. and Israel began," said Tomer Bar, AVP of Security Research at Semperis.

He added: "This is the last place we expected to find Prince of Persia hiding."

The shift underlines the difficulty facing security teams as adversaries adapt infrastructure and techniques. Rather than relying on a fixed set of indicators, defenders increasingly need to watch for changes in network behaviour, hosting patterns and communications channels that may suggest a group has altered its methods.

Australian context

For Australian organisations, the research lands against a backdrop of continued concern about state-backed intrusion activity. The Australian Signals Directorate's Australian Cyber Security Centre has previously warned that Iranian actors have targeted critical infrastructure organisations using a mix of credential theft, brute-force attempts and known software weaknesses.

Semperis urged organisations to update security controls to account for indicators of compromise identified in the research, monitor for unusual Telegram traffic and keep operating systems fully updated. Those steps are intended to reduce exposure to the techniques linked to the group's latest infrastructure.

The wider significance of the finding lies less in the identity of a single server than in the adaptability it suggests. A move from European virtual private servers to US-based shared hosting, combined with new concealment methods, indicates that threat actors are willing to relocate and retool quickly when geopolitical or operational pressures change.

Prince of Persia's activity has primarily been associated with surveillance and disruption directed at dissidents and organisations across several regions. The latest findings suggest that even well-tracked groups can still find ways to blend into mainstream internet infrastructure, forcing defenders to review assumptions about where hostile systems are likely to appear.