Iranian 'Prince of Persia' Group Uses US Infrastructure for C2 Operations
The long-active Iranian hacking group 'Prince of Persia' has been discovered operating command-and-control (C2) infrastructure from within the United States, a move researchers say is aimed at evading detection.
A sophisticated cyber-espionage campaign orchestrated by the Iranian nation-state threat group known as 'Prince of Persia' has been uncovered, utilizing command-and-control (C2) servers hosted within the United States. Cybersecurity researchers at Semperis identified this activity, noting that the group, active for approximately two decades, targets both public and private sector organizations across the US, Europe, and the Middle East, as well as dissidents and individuals opposed to the Iranian regime.
The malware employed in these campaigns is designed for intrusive data exfiltration, capable of stealing sensitive documents, capturing screenshots, and recording audio from compromised devices. Key components of the latest campaign include Foudre, a first-stage malware loader, and Tonnerre, a second-stage payload that grants attackers comprehensive surveillance capabilities. A more recent addition, Tornado malware, builds upon previous codebases and uniquely employs both HTTPS and the Telegram API as covert C2 channels, allowing it to blend with legitimate network traffic and bypass security defenses.
Prince of Persia has a history of concealing its operations, often using European hosting services and virtual private servers. However, the advanced anti-detection features of their latest malware initially obscured the campaign's hosting infrastructure. Researchers observed a period of apparent inactivity from the group around February of this year, which coincided with geopolitical events involving Iran, a pattern previously noted by security experts.
The breakthrough in identifying the US-based infrastructure came from information embedded within the Tornado malware itself. This discovery marked a significant shift, as it is the first time in at least 12 years that an Iranian threat group has been identified as hosting its malicious infrastructure on US servers, a location considered highly unexpected for such operations.
While the 'Prince of Persia' group's activities are typically highly targeted rather than widespread, their persistent nature over two decades makes them a significant threat. The use of US-based C2 infrastructure represents a notable escalation in their efforts to evade attribution and detection, potentially increasing the risk for targeted organizations.
To mitigate the risks posed by this group, Semperis recommends that organizations ensure their security controls are up-to-date, actively monitor for unusual Telegram traffic, and maintain up-to-date operating systems. The group's ability to adapt and leverage sophisticated evasion techniques, including covert C2 channels, underscores the need for continuous vigilance and robust security postures.
The discovery highlights a growing trend among sophisticated threat actors to leverage infrastructure in adversary nations to mask their activities. This tactic complicates attribution efforts and requires security researchers and defenders to employ advanced analytical techniques to uncover hidden C2 channels and infrastructure.