Semperis researchers disclosed on 22 October that Prince of Persia, an Iranian nation-state group active for roughly two decades, has been hosting command-and-control infrastructure on a US hosting provider — the first time in at least twelve years an Iranian threat group has been identified doing so. The group targets public- and private-sector organisations across the US, Europe and the Middle East, as well as dissidents opposed to the Iranian regime. Its current toolset includes the Foudre loader, the Tonnerre second-stage implant with screenshot and audio-capture surveillance capability, and Tornado, which uses both HTTPS and the Telegram API as covert channels so traffic blends with legitimate services. The researchers said Prince of Persia appeared to go dark in February, coinciding with US and Israeli strikes on Iran, and that information inside Tornado led them to the US-hosted infrastructure. Semperis recommends monitoring for unusual Telegram traffic alongside standard patch and control hygiene.

• Source article