Iranian Prince of Persia Group Found Hosting C2 Servers in the US

Semperis found that Iranian APT group Prince of Persia hosted command-and-control servers with a US hosting provider, the first such case in at least 12 years. Its Foudre, Tonnerre and Tornado malware enables full surveillance, including screenshots and audio capture, with Tornado hiding traffic in HTTPS and the Telegram API.

• Prince of Persia has operated for about two decades against US, Europe and Middle East targets
• Tornado uses HTTPS and the Telegram API as a covert C2 channel
• Tonnerre provides full surveillance, including screenshots and audio recording
• First time in 12 years an Iranian group's C2 was found on US servers