Iranian Cyber Threat Group Utilizes US Servers for Malware Operations

Cybersecurity researchers from Semperis have uncovered that an Iranian nation-state cyber threat group, referred to as 'Prince of Persia', has been utilizing command-and-control (C2) servers based in the United States to support its malware delivery and cyber-espionage campaigns. This discovery was made public on October 22, highlighting the group's longstanding activity, which spans approximately two decades.

The Prince of Persia group has been known to target both public and private sector organizations across the United States, Europe, and the Middle East, as well as individuals who oppose the Iranian regime. The malware employed in their operations is designed to facilitate intrusive data exfiltration, enabling attackers to steal sensitive documents and capture screenshots and audio from infected devices.

Among the various malware types identified in the latest campaign are Foudre, a first-stage malware loader, and Tonnerre, a second-stage malware that grants the attackers extensive surveillance capabilities. Additionally, a newer malware variant named Tornado has been discovered, which enhances the group's operational stealth by using both HTTPS and the Telegram API as covert C2 channels. This allows the malware to blend in with legitimate network traffic, making it more challenging for security measures to detect.

Historically, Prince of Persia has concealed its activities within European hosting services and virtual private servers. However, the advanced anti-detection capabilities of their malware initially complicated efforts to pinpoint the hosting locations of their latest campaign. Tomer Bar, the AVP of security research at Semperis, noted that the group appeared to go silent in February, coinciding with military strikes by the US and Israel against Iran, a pattern often observed during geopolitical conflicts involving the nation.

Discovery of US Hosting for Malware

The breakthrough in identifying the group's current operations came from information extracted from the Tornado malware, which ultimately led researchers to a US-based hosting company. This revelation is particularly noteworthy, as it marks the first instance in over a decade where an Iranian threat group has been found to host its activities on US servers.

Final Assessment

While it is not uncommon for threat groups to obscure their operations within US hosting providers, the presence of Prince of Persia in this context raises significant concerns. Bar expressed surprise at the discovery, stating, "This is the last place we expected to find Prince of Persia hiding."

Despite the group's highly targeted approach, its persistent cyber threat to organizations has been evident for nearly twenty years. To mitigate risks associated with potential attacks from Prince of Persia, Semperis has recommended several protective measures for organizations to consider.