Tag: Shared Hosting

  • Iran-Linked Group’s First US C2 in 10 Years Makes Domestic Hosting a Threat Surface

    Iran-Linked Group’s First US C2 in 10 Years Makes Domestic Hosting a Threat Surface

    TL;DR · 30-second read

    The Short Version

    A hacking group that a security company links to Iran’s government spent years running its operations from rented computers in Europe. This year, it moved a key one to the United States.

    That computer is the group’s remote control. It sends orders to infected devices and collects what they steal. Its recent targets are mostly Iranian dissidents.

    The group hid it on shared web hosting. That is rented space that sits right next to ordinary websites. This makes the group’s computer much harder to find, and much harder to block without also cutting off innocent sites.

    Semperis, an identity security company based in Hoboken, New Jersey, said on October 22, 2026 that Tomer Bar, its AVP of Security Research, found the Iranian nation-state-sponsored threat group known as Prince of Persia running a command-and-control (C2) server in the United States. A C2 server is the machine attackers use to send instructions to infected computers and receive stolen data. Bar found the server in August 2026. Bar has tracked the group for 10 years, and this is only the second time he has found it running C2 on US soil. The first was in 2016.

    According to Semperis, the group went dark after the conflict between Iran and the US and Israel began on February 28. It then re-emerged on shared hosting, with a changed remote management panel and new infrastructure built behind Cloudflare. Its recent victims are primarily Iranian dissidents.

    Executive Summary

    A single server matters less here than the way it was hidden. Prince of Persia previously relied on European hosting and virtual private servers (VPS), which are rented slices of a physical machine that one customer controls alone. It has now moved to shared hosting, where many unrelated customers’ websites run on the same server and often share an IP address. It has also put new infrastructure behind Cloudflare, a widely used service that sits in front of websites to speed them up and protect them, and that also conceals the address of the server behind it.

    For people who run data centers, hosting platforms and enterprise networks, the consequence is practical. Defenders often rely on three signals: where a server is hosted, which IP address it uses, and which domain names it answers to. All three become weak evidence when a hostile server looks like a domestic, shared, professionally fronted website. The group adds three more layers of resilience: Telegram’s programming interface, domain-generation algorithms and blockchain-based exfiltration. Each is designed so that losing one piece does not end the operation.

    Semperis’s recommendations are basic. It advises organizations to load the published indicators of compromise (IOCs), the technical fingerprints of the attack, into their security tools, watch for unusual Telegram traffic and keep operating systems patched. The most immediately useful part of the announcement is the IOC set in the full research. The broader point about hosting comes from one discovered server and one group, and should be weighed that way.

    A Decade of European Hosting, Then a US Address

    According to Semperis, Prince of Persia’s infrastructure has been predictable for most of the past decade. It used European hosting and virtual private servers, with one US-based C2 server found in 2016. The August 2026 discovery breaks that pattern. Bar’s comment shows how strongly researchers had come to rely on it: “This is the last place we expected to find Prince of Persia hiding.”

    The timing adds to the surprise. Bar noted that groups tied to Iran often go quiet during geopolitical conflict involving Iran, and that Prince of Persia went dark in February. What he did not expect was the group’s choice to host new C2 in the US at the same time the conflict began. Semperis does not offer a motive, and it would be speculation to supply one. Blending in, testing new infrastructure and opportunistic use of cheap hosting are all possible explanations, and the evidence offered supports none of them over the others.

    What can be said is narrower and more useful. A group with a long, documented habit of hosting abroad changed its hosting geography and its hosting model together. When a threat actor makes that kind of change, defenses tuned to its old habits stop working quietly.

    Shared Hosting Blurs the Lines Defenders Draw

    The mechanism behind the headline is simple. On a dedicated server or a VPS, an IP address maps roughly to one customer, so blocking that address hits the attacker and few others. On shared hosting, one address can serve many unrelated websites. Behind a reverse proxy such as Cloudflare, the visible address belongs to the proxy’s network, which also fronts a very large number of legitimate sites. Blocking it either fails or cuts off innocent services. Semperis describes the result as hiding operations “alongside benign websites and infrastructure used by other threat actors.”

    The domestic element makes this worse. Many security programs treat connections to foreign or unfamiliar hosting as a risk signal and treat domestic, mainstream infrastructure as normal. A US-hosted C2 server behind a major content delivery network produces traffic that looks ordinary. This is the sense in which domestic shared hosting becomes part of the threat surface. It is not newly dangerous. It simply can no longer be trusted by default.

    Several groups feel the effect. Shared-hosting providers own the customer-onboarding and abuse-handling processes where a tenant like this could be noticed. Reverse-proxy and CDN operators receive the abuse reports that lead to takedowns. Enterprise security teams have to move from address-based blocking toward detection based on behavior: what a process does, who it talks to and when. The targets, here mainly Iranian dissidents, depend on all three working together. One server from one group does not show a broad migration onto US infrastructure, and it should not be read as one. It does show that the technique works well enough for a long-running state-backed group to adopt it.

    Built to Survive a Takedown

    The hosting change is only one layer. Semperis says the group also relies on three other techniques. The first is Telegram API channels, which pass commands through a popular messaging service that many networks allow by default. The second is domain-generation algorithms, in which malware calculates a fresh list of domain names to contact, so blocking any single domain does not cut the link. The third is blockchain-based exfiltration, which uses a public blockchain as part of how stolen data is moved and which no single hosting provider can remove.

    Together these mean that taking down one server, even after a provider is notified, disrupts the operation without necessarily ending it. That changes what “response” means for infrastructure operators. A takedown is necessary but partial, and the more durable defense is detecting the behavior on the endpoint and the network.

    Measured against that, Semperis’s three recommendations are sound but baseline: load the IOCs, watch for unusual Telegram traffic and patch operating systems. They suit an organization that already has detection tooling. They say little about what a hosting provider, or a team that cannot block Telegram outright, should do differently. The full research and IOC set is where defenders will find most of the operational value.

    Background

    Semperis focuses on protecting identity systems, the directories and sign-in services such as Active Directory, Entra ID, Okta and Ping Identity that control who can access what inside an organization. Alongside its commercial platform, it runs the Hybrid Identity Protection conference and podcast and offers free tools including Purple Knight and Forest Druid. Its security research team publishes threat analysis such as this report.

    Prince of Persia has been tracked by Tomer Bar for a decade. Over that time, according to Semperis, the group has mostly hosted its control infrastructure in Europe. It has typically gone quiet during geopolitical conflict involving Iran, and it has steadily refined its malware and its methods for staying in contact with infected machines. Before 2026, the only previously known US-hosted C2 server linked to the group was found in 2016.

    Sources

    Source: Semperis Researcher Discovers an Iranian Nation-State-Sponsored Threat Group Operating Command-and-Control Infrastructure in the United States, Semperis’s announcement of the Prince of Persia findings, with full research and indicators of compromise at Prince of Persia Threat Group Hiding in Plain Sight.

  • One Script, 15+ Government Tenants: Why Shared Hosting Multiplies Espionage Risk

    One Script, 15+ Government Tenants: Why Shared Hosting Multiplies Espionage Risk

    TL;DR · 30-second read

    The Short Version

    Security researchers at Symantec say a small hacking crew based in China spent months reading the email of government officials across Asia and the Middle East. It also ran a cryptocurrency scam business from the same control screen.

    Its most effective move: instead of breaking into government ministries one at a time, it broke into the single company that hosted all of their email. One planted piece of code reached more than 15 government email systems at once.

    The takeaway is simple. When many organizations rely on one shared provider, one break-in can expose all of them.

    Industrial Cyber reported on August 14 that Symantec’s Threat Hunter Team, working with Carbon Black researchers, has exposed Jewelbug, which Symantec describes as a China-based hackers-for-hire group. According to Symantec, the group ran espionage campaigns against governments, militaries and state telecom operators across the Middle East, Southeast Asia and South Asia. It also ran a cryptocurrency fraud operation aimed at Chinese-speaking victims, and both activities were managed from a single browser-based control panel called XG-Web.

    In under three months, Symantec found, the group logged more than one million implant check-ins and stole over 580,000 browser cookies, thousands of credentials and more than 2,300 email bodies. An implant is a piece of malware that reports back to its operators. Its largest operation compromised a shared web-hosting platform run by a Middle Eastern state telecom provider, which placed malicious code in front of more than 15 government webmail tenants at once.

    Executive Summary

    Symantec’s research is unusually detailed. It is built on visibility into the group’s own control panel and victim database, so it describes more than a list of intended targets. It documents actual compromises: harvested mailboxes of senior officials, intercepted internal network traffic, and implants running on Windows machines, Linux servers and network devices. Jewelbug is also tracked under other names, including Earth Alux, REF7707 and CL-STA-0049.

    For infrastructure operators, the most important finding is architectural rather than about any single piece of malware. Jewelbug did not breach each ministry one by one. It gained write access to a centrally hosted webmail system run by a state telecom and planted one script, and that script fired for every ministry employee who logged in. A second finding points in the same direction. The group’s Linux and router implant, ClientKing, is built to reach servers and network equipment, the layer that carries everyone else’s traffic.

    Symantec also reported that some ClientKing builds were configured to route traffic through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer. That extends the group’s footprint beyond Asia and the Middle East into industrial infrastructure.

    One Write Permission, Fifteen Ministries

    The shared-hosting compromise is the clearest demonstration in Symantec’s report of how multi-tenancy changes the economics of an attack. Multi-tenancy means many customers running on one platform. The Middle Eastern government’s ministries did not each run their own mail servers. They were tenants on a web-hosting platform operated by the state telecommunications provider. Once Jewelbug had write access to the central webmail system, it needed only one malicious script. That script ran each time any ministry staff member logged in or checked their email, across more than 15 government tenants.

    The attack chain that followed was conventional, and that is part of the lesson. The injected code captured session cookies and email addresses. Session cookies are the small tokens that keep a user logged in, and stealing one can let an attacker impersonate that user without a password. Windows users were then shown a fake Adobe Flash update prompt, which installed Antino, the group’s backdoor. Antino added a malicious browser extension that gave operators control of the browser and a route into internal government networks. None of these steps required a novel exploit against each ministry, because the shared platform had already delivered every tenant to the attacker.

    Symantec’s own summary makes the point directly: compromising a shared hosting provider and placing a watering hole on every government tenant turned a single intrusion into access across an entire national webmail estate. A watering hole is a trusted site rigged to infect the people who visit it. The implication for telecoms, hosting providers and data center operators that serve government or regulated customers is that the provider’s control plane is part of every tenant’s attack surface. The control plane is the administrative layer with write access to shared code. Tenant isolation at the data layer does little if one set of credentials can change the code all tenants run.

    The Network Layer Is in Scope

    Most espionage reporting centres on endpoints: laptops, email and browsers. Jewelbug’s toolkit goes further. According to Symantec, ClientKing is a Linux and router implant that can reach servers and network devices, and all of the group’s implants feed one victim database. Routers and Linux servers sit below the level where most endpoint detection tools operate. They often run for years between refreshes, and they see traffic from many downstream users at once.

    That matters for the telecom operators Symantec says were targeted. A foothold on network infrastructure can outlast a cleaned-up laptop and can observe traffic rather than just one user’s files. Symantec noted that the group intercepted internal network traffic, and that the common thread across its espionage targets was government communications and the providers that host them. The researchers said that combination would give an intelligence customer broad, durable access to official correspondence.

    The detail about the U.S. aerospace and industrial manufacturer needs careful reading. Symantec said a couple of ClientKing builds were configured to beacon through that company’s internal corporate proxy. That shows the group’s tooling was set up to operate inside or through that environment. The report as described does not establish the extent of any compromise there.

    A Hack-for-Hire Business Model, Visible From the Inside

    Symantec’s central attribution finding is that foreign-government espionage and commodity cryptocurrency fraud ran on the same infrastructure, by the same small team, from one control panel. The researchers call that pairing the signature of a hack-for-hire entity running for-profit crime on the side. They tied the fraud and search-engine-optimisation arm, with high confidence, to the sole legal representative of an SEO company in Changsha, Hunan Province. That attribution rests on identity documents, a business license and a stamped authorization letter. Symantec was explicit that the link between this individual and the espionage operators is not fully established. Its assessment is that the SEO business most likely supplied access, infrastructure and delivery.

    The operational discipline is notable for defenders. The group has built five generations of command-and-control code, the servers and software attackers use to direct their malware. A scheduled job checked its own domains against VirusTotal every 12 hours so operators could rotate away from anything flagged. VirusTotal is a widely used public malware-scanning service. Antino disguised its communications as ordinary Microsoft cloud traffic. Taken together, these choices suggest that blocklists and domain reputation alone will lag this kind of operator. Behavioural monitoring and integrity checks on shared code are better placed to catch it.

    For hosting and telecom operators, the practical questions are about blast radius. Who holds write access to code that every tenant executes? Is that code monitored for unauthorized changes? Are session tokens bound tightly enough that a stolen cookie is of limited use? None of these are exotic controls. The Jewelbug case shows what happens when one of them fails on a platform many customers share.

    Background

    Symantec is one of the longest-established names in enterprise security. Its enterprise business has been part of Broadcom since 2019, and its Threat Hunter Team publishes research on state-linked and criminal hacking groups alongside Carbon Black, another Broadcom-owned security brand. Different vendors often track the same group under different names, which is why Jewelbug also appears in industry reporting as Earth Alux, REF7707 and CL-STA-0049.

    Telecom operators and hosting providers have long been attractive espionage targets because they sit upstream of many customers at once. Governments in many regions consolidate ministry email and web services onto shared platforms, often run by a state telecom, to cut cost and complexity. The Jewelbug case shows the other side of that trade-off: consolidation also concentrates risk. Earlier in 2026, Symantec reported on Seedworm, an Iran-linked group whose campaigns spanned government, airport, manufacturing and financial targets.

    Sources

    Source: Symantec reveals Jewelbug espionage campaign targeting Asian governments, telecoms, critical infrastructure (Industrial Cyber): coverage of Symantec’s findings on a China-based hack-for-hire group running espionage and cryptocurrency fraud from one control panel.