Iran‑linked Prince of Persia APT Re‑Establishes US Command Server After Six‑Year Hiatus

After a three‑month pause, the Iranian cyber‑espionage group known as Prince of Persia has placed a new command‑and‑control server on a shared‑hosting platform in the United States, marking its first US‑based infrastructure since 2016.

The group, which analysts tie to Iran’s Ministry of Intelligence, has a history of targeting diplomatic missions, academic institutions and energy firms across the globe. Its operations typically rely on compromised web servers, cloud instances and other publicly accessible services to hide malicious traffic among legitimate users.

Security researchers identified the fresh server as a Tornado C2 node, running on standard web ports to blend in with ordinary web traffic. The server was hosted on a commercial shared‑hosting provider and was active for a brief window before being taken offline.

Re‑appearing on US soil may reflect a tactical adjustment aimed at improving latency for North American victims or exploiting the higher trust placed in domestic hosting services. The development also underscores the risk that US providers can inadvertently become hosts for foreign advanced persistent threat (APT) infrastructure.

The three‑month lull followed a series of takedowns by law‑enforcement and private‑sector partners that forced Prince of Persia to shift much of its infrastructure to Europe and Asia. Its return to the United States suggests the group is adapting its operational playbook in response to those disruptions.

Experts warn that the APT is likely to continue rotating C2 nodes across multiple jurisdictions to evade detection. Ongoing monitoring of shared‑hosting environments and improved attribution capabilities are expected to remain key priorities for defenders seeking to disrupt the group’s future campaigns.