Security firm Semperis says it has identified command-and-control (C2) infrastructure linked to an Iranian state-sponsored threat group hosted in the United States, a shift it says it has not observed for at least a decade.
The company’s research focuses on a group it refers to as “Prince of Persia”, which Semperis says has been active for nearly two decades and has primarily targeted Iranian dissidents and public and private sector organisations across the United States, Europe and the Middle East.
According to Semperis, the discovery was made in August 2026 by Tomer Bar, the company’s AVP of Security Research. The company says the group has adjusted its hosting approach and infrastructure to reduce the chance of detection, including using shared hosting, changing its remote management panel and building new infrastructure behind Cloudflare.
Semperis says the threat group previously relied on European hosting and virtual private servers, and that it “went dark” after the start of a conflict involving Iran, the United States and Israel on 28 February 2026 before re-emerging with changes to its infrastructure.
“Prince of Persia went dark in February 2026 at the beginning of the conflict with the U.S. and Israel. This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group. What surprised me this time, however, was the threat actor’s decision to host the new C2 server for the first time in 10 years on U.S. soil, at the same time the conflict with the U.S. and Israel began,” said Bar. “This is the last place we expected to find Prince of Persia hiding.”
The research comes as Australia, New Zealand, the United States and 30 other nations issued a joint statement condemning cyberattacks attributed to Iran. Separately, the Australian Signals Directorate’s Australian Cyber Security Centre has warned that Iranian state-sponsored cyber actors have compromised critical infrastructure using techniques including brute-force attacks, stolen credentials and exploitation of known vulnerabilities.
Semperis said its findings were relevant for Australian organisations in an evolving state-sponsored threat environment, pointing to the need to monitor suspicious network activity, strengthen detection capabilities and ensure controls can identify changing tactics.
In the release, Semperis recommended organisations update security controls to protect against indicators of compromise referenced in the research, monitor for unusual Telegram traffic and ensure operating systems are fully updated.
Semperis has published the research and associated indicators of compromise at https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/.
