Iranian APT Prince of Persia hosts C2 infrastructure on US servers in Foudre, Tonnerre and Tornado espionage campaign
Researchers at Semperis reported on October 22 that the Iranian state-linked group Prince of Persia, active for about two decades, is hosting command-and-control (C2) infrastructure with a US hosting company. According to Semperis, this is the first time in at least 12 years that an Iranian threat group has been identified hosting its activity on US servers. The group targets public and private sector organisations in the US, Europe and the Middle East, as well as dissidents and opponents of the Iranian regime. Its malware allows theft of documents, covert screenshots and audio capture. The group appeared to go dark in February 2026, coinciding with US and Israeli strikes against Iran, according to Tomer Bar of Semperis.
Detalhes técnicos
- Foudre is a first-stage loader; Tonnerre is a second-stage implant that gives full surveillance capabilities.
- Tornado is a more recently identified malware that builds on the codebase of earlier tooling. It can use both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate traffic to evade firewalls and detection.
- The group previously hid activity on European hosting services and VPS providers. Anti-detection features initially hindered researchers, but information inside Tornado revealed where the campaign was hosted.
- The article gives no IOCs, CVEs or initial access vector.
Remediação
Semperis recommends:
- Keeping security controls up to date.
- Monitoring for unusual Telegram traffic.
- Keeping operating systems fully updated.
Linha do tempo
-
Iranian APT Prince of Persia hosts C2 infrastructure on US servers in Foudre, Tonnerre and Tornado espionage campaign
ler a análise desta fonte ocultar
Researchers at Semperis reported on October 22 that the Iranian state-linked group Prince of Persia, active for about two decades, is hosting command-and-control (C2) infrastructure with a US hosting company. According to Semperis, this is the first time in at least 12 years that an Iranian threat group has been identified hosting its activity on US servers. The group targets public and private sector organisations in the US, Europe and the Middle East, as well as dissidents and opponents of the Iranian regime. Its malware allows theft of documents, covert screenshots and audio capture. The group appeared to go dark in February 2026, coinciding with US and Israeli strikes against Iran, according to Tomer Bar of Semperis.
Technical Details
- Foudre is a first-stage loader; Tonnerre is a second-stage implant that gives full surveillance capabilities.
- Tornado is a more recently identified malware that builds on the codebase of earlier tooling. It can use both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate traffic to evade firewalls and detection.
- The group previously hid activity on European hosting services and VPS providers. Anti-detection features initially hindered researchers, but information inside Tornado revealed where the campaign was hosted.
- The article gives no IOCs, CVEs or initial access vector.
Remediation
Semperis recommends:
- Keeping security controls up to date.
- Monitoring for unusual Telegram traffic.
- Keeping operating systems fully updated.