Semperis finds Iranian Prince of Persia group hosting C2 server in the US

Semperis discovered in August 2026 a command-and-control server of the Iranian state-sponsored Prince of Persia group hosted in the United States — the first time in a decade. After going dark in February 2026, the group moved to shared hosting, changed its management panel and hid infrastructure behind Cloudflare, using Telegram API, domain-generation algorithms and blockchain-based exfiltration.

• Prince of Persia C2 server hosted in the US for the first time in 10 years
• Group moved to shared hosting and Cloudflare after going dark in February 2026
• It uses Telegram API, DGA and blockchain for resilient C2 and exfiltration
• The group has targeted Iranian dissidents and organisations for nearly two decades