Prince of Persia found hosting command-and-control servers in the US
Original title: Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Semperis traced Tornado malware to a US host after the group appeared quiet following February strikes on Iran.
Semperis says the Iranian group Prince of Persia used US-based command-and-control servers for malware delivery and espionage. Campaign malware includes the Foudre loader, second-stage Tonnerre, and newer Tornado, which can use HTTPS and the Telegram API. The group targets public and private organizations in the US, Europe and the Middle East, as well as dissidents. Researchers say anti-detection features initially hid the hosting location.
Unconfirmed: Semperis says the group seemed to go dark in February and that Iranian C2 on US servers had not been identified for at least 12 years.
- Foudre is the first-stage loader and Tonnerre is the second-stage surveillance malware.
- Tornado can use HTTPS and the Telegram API as a covert command channel.
- Semperis says the latest campaign was hosted at a US hosting company.
- Targets include US, European and Middle Eastern organizations, plus regime opponents.
Impact: Document theft plus covert screenshots and audio capture
- 1.Monitor for unusual Telegram traffic.
- 2.Keep operating systems fully updated.
- Threat actors
- Prince of Persia
- Organizations
- Semperis
- Countries
- IranUnited States
From the original article
2 min read at infosecurity-magazine.com
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil
By Danny Palmer · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.