Iranian ‘Prince of Persia’ Group Operates Command Servers from Within United States

Security researchers have identified that a covert Iranian threat group known as “Prince of Persia” is running command‑and‑control (C2) servers on U.S. hosting platforms, giving the campaign a foothold on American soil.

The group, which has been linked to a series of stealthy malware deployments, targets organizations across multiple sectors worldwide. Its tools are designed to evade detection, often leveraging zero‑day exploits and custom encryption to maintain persistence in compromised networks.

The discovery was made by a joint effort of independent security analysts and a U.S. computer‑incident response team, who traced network traffic from infected hosts back to several American data‑center IP ranges. Analysis of server logs and domain registrations revealed that the infrastructure was provisioned through legitimate hosting providers, masking the true origin of the attacks.

Victims reported a range of impacts, from data exfiltration to the installation of remote access trojans that enable ongoing espionage. While the campaign’s primary focus appears to be intelligence gathering, some compromised entities have suffered operational disruption, highlighting the group’s capacity to blend espionage with sabotage.

The presence of foreign‑controlled C2 servers inside the United States raises concerns for national cybersecurity policy. Hosting malicious infrastructure domestically can reduce latency for attackers, simplify logistics, and complicate attribution efforts, thereby increasing the threat level for both private and public sector networks.

U.S. law‑enforcement agencies have opened investigations into the hosting accounts, and several providers have been notified to suspend the identified services. The Federal Bureau of Investigation’s Cyber Division has issued alerts urging organizations to monitor for indicators of compromise associated with the “Prince of Persia” toolkit.

Cybersecurity experts note that the tactic of situating command infrastructure within target countries is not new, but the scale and sophistication observed in this case suggest a growing willingness among state‑aligned groups to exploit trusted domestic services. The move underscores the importance of rigorous vetting by hosting firms and heightened collaboration between the private sector and government entities.

Analysts will continue to track the group’s activity, looking for signs of new payloads or shifts in target selection. Organizations are advised to strengthen network segmentation, apply regular patching cycles, and employ threat‑intel feeds that flag the specific signatures linked to the “Prince of Persia” operations.