Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Prince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations, according to Semperis.
The APT actor, also tracked as Infy, has been operating for close to 20 years. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe, and the Middle East.
Tomer Bar, AVP of security research at Semperis, tracked the group in his previous role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report, the hackers took a C&C server offline and later relocated the rest of their servers.
Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel, which broke out...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
