TL;DR · 30-second read
The Short Version
A hacking group that a security company links to Iran’s government spent years running its operations from rented computers in Europe. This year, it moved a key one to the United States.
That computer is the group’s remote control. It sends orders to infected devices and collects what they steal. Its recent targets are mostly Iranian dissidents.
The group hid it on shared web hosting. That is rented space that sits right next to ordinary websites. This makes the group’s computer much harder to find, and much harder to block without also cutting off innocent sites.
Semperis, an identity security company based in Hoboken, New Jersey, said on October 22, 2026 that Tomer Bar, its AVP of Security Research, found the Iranian nation-state-sponsored threat group known as Prince of Persia running a command-and-control (C2) server in the United States. A C2 server is the machine attackers use to send instructions to infected computers and receive stolen data. Bar found the server in August 2026. Bar has tracked the group for 10 years, and this is only the second time he has found it running C2 on US soil. The first was in 2016.
According to Semperis, the group went dark after the conflict between Iran and the US and Israel began on February 28. It then re-emerged on shared hosting, with a changed remote management panel and new infrastructure built behind Cloudflare. Its recent victims are primarily Iranian dissidents.
Executive Summary
A single server matters less here than the way it was hidden. Prince of Persia previously relied on European hosting and virtual private servers (VPS), which are rented slices of a physical machine that one customer controls alone. It has now moved to shared hosting, where many unrelated customers’ websites run on the same server and often share an IP address. It has also put new infrastructure behind Cloudflare, a widely used service that sits in front of websites to speed them up and protect them, and that also conceals the address of the server behind it.
For people who run data centers, hosting platforms and enterprise networks, the consequence is practical. Defenders often rely on three signals: where a server is hosted, which IP address it uses, and which domain names it answers to. All three become weak evidence when a hostile server looks like a domestic, shared, professionally fronted website. The group adds three more layers of resilience: Telegram’s programming interface, domain-generation algorithms and blockchain-based exfiltration. Each is designed so that losing one piece does not end the operation.
Semperis’s recommendations are basic. It advises organizations to load the published indicators of compromise (IOCs), the technical fingerprints of the attack, into their security tools, watch for unusual Telegram traffic and keep operating systems patched. The most immediately useful part of the announcement is the IOC set in the full research. The broader point about hosting comes from one discovered server and one group, and should be weighed that way.
A Decade of European Hosting, Then a US Address
According to Semperis, Prince of Persia’s infrastructure has been predictable for most of the past decade. It used European hosting and virtual private servers, with one US-based C2 server found in 2016. The August 2026 discovery breaks that pattern. Bar’s comment shows how strongly researchers had come to rely on it: “This is the last place we expected to find Prince of Persia hiding.”
The timing adds to the surprise. Bar noted that groups tied to Iran often go quiet during geopolitical conflict involving Iran, and that Prince of Persia went dark in February. What he did not expect was the group’s choice to host new C2 in the US at the same time the conflict began. Semperis does not offer a motive, and it would be speculation to supply one. Blending in, testing new infrastructure and opportunistic use of cheap hosting are all possible explanations, and the evidence offered supports none of them over the others.
What can be said is narrower and more useful. A group with a long, documented habit of hosting abroad changed its hosting geography and its hosting model together. When a threat actor makes that kind of change, defenses tuned to its old habits stop working quietly.
Shared Hosting Blurs the Lines Defenders Draw
The mechanism behind the headline is simple. On a dedicated server or a VPS, an IP address maps roughly to one customer, so blocking that address hits the attacker and few others. On shared hosting, one address can serve many unrelated websites. Behind a reverse proxy such as Cloudflare, the visible address belongs to the proxy’s network, which also fronts a very large number of legitimate sites. Blocking it either fails or cuts off innocent services. Semperis describes the result as hiding operations “alongside benign websites and infrastructure used by other threat actors.”
The domestic element makes this worse. Many security programs treat connections to foreign or unfamiliar hosting as a risk signal and treat domestic, mainstream infrastructure as normal. A US-hosted C2 server behind a major content delivery network produces traffic that looks ordinary. This is the sense in which domestic shared hosting becomes part of the threat surface. It is not newly dangerous. It simply can no longer be trusted by default.
Several groups feel the effect. Shared-hosting providers own the customer-onboarding and abuse-handling processes where a tenant like this could be noticed. Reverse-proxy and CDN operators receive the abuse reports that lead to takedowns. Enterprise security teams have to move from address-based blocking toward detection based on behavior: what a process does, who it talks to and when. The targets, here mainly Iranian dissidents, depend on all three working together. One server from one group does not show a broad migration onto US infrastructure, and it should not be read as one. It does show that the technique works well enough for a long-running state-backed group to adopt it.
Built to Survive a Takedown
The hosting change is only one layer. Semperis says the group also relies on three other techniques. The first is Telegram API channels, which pass commands through a popular messaging service that many networks allow by default. The second is domain-generation algorithms, in which malware calculates a fresh list of domain names to contact, so blocking any single domain does not cut the link. The third is blockchain-based exfiltration, which uses a public blockchain as part of how stolen data is moved and which no single hosting provider can remove.
Together these mean that taking down one server, even after a provider is notified, disrupts the operation without necessarily ending it. That changes what “response” means for infrastructure operators. A takedown is necessary but partial, and the more durable defense is detecting the behavior on the endpoint and the network.
Measured against that, Semperis’s three recommendations are sound but baseline: load the IOCs, watch for unusual Telegram traffic and patch operating systems. They suit an organization that already has detection tooling. They say little about what a hosting provider, or a team that cannot block Telegram outright, should do differently. The full research and IOC set is where defenders will find most of the operational value.
Background
Semperis focuses on protecting identity systems, the directories and sign-in services such as Active Directory, Entra ID, Okta and Ping Identity that control who can access what inside an organization. Alongside its commercial platform, it runs the Hybrid Identity Protection conference and podcast and offers free tools including Purple Knight and Forest Druid. Its security research team publishes threat analysis such as this report.
Prince of Persia has been tracked by Tomer Bar for a decade. Over that time, according to Semperis, the group has mostly hosted its control infrastructure in Europe. It has typically gone quiet during geopolitical conflict involving Iran, and it has steadily refined its malware and its methods for staying in contact with infected machines. Before 2026, the only previously known US-hosted C2 server linked to the group was found in 2016. Source: Semperis Researcher Discovers an Iranian Nation-State-Sponsored Threat Group Operating Command-and-Control Infrastructure in the United States, Semperis’s announcement of the Prince of Persia findings, with full research and indicators of compromise at Prince of Persia Threat Group Hiding in Plain Sight.Sources