Recent research by Semperis has revealed that the Iranian cyber group known as Prince of Persia has re-established its command-and-control (C2) infrastructure within the United States, marking a significant shift in its operational strategy after nearly a decade. This discovery, made by Tomer Bar, Semperis’ AVP of Security Research, indicates that the group has adapted its tactics to conceal its malicious activities more effectively.
Bar, who has been monitoring Prince of Persia for over ten years, noted that this is the first instance of the group operating C2 servers in the US since 2016. The new server was identified in August 2026, coinciding with the onset of heightened geopolitical tensions involving Iran, the US, and Israel. Historically, Prince of Persia has relied on European hosting services, making this shift to US-based infrastructure particularly noteworthy.
Operational Changes and Tactics
The group has implemented several changes to its infrastructure to evade detection. These include transitioning to shared hosting environments and utilizing Cloudflare to obscure its operations among legitimate websites. Additionally, Prince of Persia has adopted advanced techniques such as domain-generation algorithms and Blockchain-based exfiltration methods to maintain a resilient C2 framework.
Recent targets of the group have primarily included Iranian dissidents, highlighting the ongoing threat posed by state-sponsored cyber activities. Bar emphasized the unusual nature of this development, stating, “Prince of Persia went dark in February 2026 at the beginning of the conflict with the US and Israel. This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group. What surprised me this time, however, was the threat actor’s decision to host the new C2 server for the first time in 10 years on US soil.”
Implications for Cybersecurity
The resurgence of Prince of Persia’s operations in the US raises significant concerns for cybersecurity professionals and government entities alike. The group’s ability to adapt and conceal its activities suggests a sophisticated understanding of current cybersecurity defenses and highlights the need for enhanced vigilance among organizations, particularly those involved in monitoring dissident activities or geopolitical tensions.
As the situation evolves, it will be crucial for cybersecurity leaders and decision-makers in the region to remain informed about the tactics employed by such threat actors and to bolster their defenses against potential incursions. The implications of this development extend beyond immediate cybersecurity concerns, reflecting broader geopolitical dynamics that could influence cyber threat landscapes in the Middle East and beyond.
For further insights into this discovery and its implications, refer to the full report by Semperis on Intelligent CISO.
