Eronning “Fors shahzodasi” APT guruhi 2016-yildan beri birinchi marta AQShda C&C serverini joylashtirdi

Eron hukumati homiyligidagi “Fors shahzodasi” (Prince of Persia) tahdid guruhi bu yil o‘zining buyruq va nazorat (C&C) serverlaridan birini AQShdan ishga tushirdi — bu uning operatsiyalaridagi bir necha oylik tanaffusdan so‘ng sodir bo‘ldi, deb xabar berdi Semperis.

Infy nomi bilan ham kuzatiladigan ushbu APT aktyori deyarli 20 yildan beri faoliyat yuritmoqda. Uning nishonlari asosan eronlik dissidentlar, shuningdek AQSh, Yevropa va Yaqin Sharqdagi davlat va xususiy tashkilotlardir.

Semperisning xavfsizlik tadqiqotlari bo‘yicha AVPsi Tomer Bar o‘zining SafeBreach’dagi avvalgi lavozimida ushbu guruhni kuzatgan. Uning aytishicha, SafeBreach’ning 2026-yil fevral oyidagi hisobotidan bir hafta ichida xakerlar bitta C&C serverni o‘chirib, keyinchalik qolgan serverlarini boshqa joyga ko‘chirishgan.

Shundan so‘ng “Fors shahzodasi” operatsiyalarini uch oyga to‘xtatdi — bu uning deyarli yigirma yillik tarixidagi har qanday boshqa sukunatdan uzoqroq edi. Bu tanaffus Eron, AQSh va Isroil o‘rtasidagi urush bilan bir vaqtda sodir bo‘ldi, u 28-fevralda boshlangan.

Semperis SecurityWeek’ga ma’lum qilishicha, bu ular tasdiqlagan eng uzoq tanaffusdir, chunki tadqiqotchilar butun vaqt davomida guruh infratuzilmasini kuzatib borishgan. Avvalgi sukunat davrlari tadqiqotchilarning guruh operatsiyalarini ko‘rishidagi bo‘shliqlarni aks ettirgan, tasdiqlangan faoliyatsizlik emas.

“Fors shahzodasi” operatsiyalari 27-mayda yangi C&C server joylashtirilishi bilan qayta boshlandi va ma’lumotlar o‘g‘irlanishi tiklandi. Yetti kun ichida guruhning zararli dasturlar oilasidan biri bo‘lgan Tonnerre bitta qurbonchidan 1800 dan ortiq faylni o‘g‘irlab olgan.

Reklama. O‘qishni davom ettirish uchun pastga aylantiring.

Barning aytishicha, qurbonchilar soni hali ham kichik, bu guruhning yo maqsadli hujumlar o‘tkazayotgani, yo yangi tizimlarni buzishda qiynalayotganining belgisi bo‘lishi mumkin.

Avgust oyida Bar 7-iyulda qurilgan bo‘lishi mumkin bo‘lgan yangi serverni aniqladi, u Tornado’ning ikkinchi bosqichini qo‘llab-quvvatlaydi. Tornado — guruhning eng so‘nggi zararli dasturlar oilasi bo‘lib, uning imkoniyatlari Telegram bot orqali fayllarni o‘g‘irlashni o‘z ichiga oladi.

Barning aytishicha, server AQShda joylashgan bo‘lib, bu 2016-yildan beri guruhning mamlakat ichida C&C serverini joylashtirgan birinchi holatdir.

“Davlat homiyligidagi tahdid guruhlari uchun AQSh ichida bulut infratuzilmasi va veb-xosting provayderlaridan foydalanib C2 serverlarini yashirish odatiy hol emas, lekin bu tahdid aktyori uchun bu g‘ayrioddiy xatti-harakatdir,” deb ta’kidlaydi Bar.

Ushbu server uchun hujumchilar provayderlarni almashtirishdi. Ular shuningdek virtual xususiy serverlardan (VPS) voz kechib, Namecheap umumiy xostingini tanlashdi — bu minglab domenlar, jumladan qonuniy saytlar va boshqa tahdid aktyorlari tomonidan boshqariladigan ba’zi saytlar joylashgan joy.

“Bu “Fors shahzodasi”ni yashiringan holda topishni kutgan oxirgi joyimiz edi,” dedi Bar.

24-avgustda guruh Cloudflare ortida yashiringan Tornado’ning ikkinchi bosqich serverini o‘rnatishni boshladi. Semperis xakerlar AQShda joylashgan serverlari fosh bo‘lganini anglab yetgan deb gumon qiladi.

Semperis “Fors shahzodasi” infratuzilmasi bilan bog‘liq IoC’larni ulashgan. U tashkilotlarga ularni xavfsizlik vositalariga qo‘shishni va shubhali Telegram trafikini kuzatishni maslahat beradi.

Bog‘liq: Kamdan-kam uchraydigan harakatda, go‘yoki eronlik davlat xakeri AQShga ekstraditsiya qilindi

Bog‘liq: AQSh, Buyuk Britaniya va Niderlandiya agentliklari eronlik “Chosen Brick” kuzatuv zararli dasturini fosh qildi

Muallif: Eduard Kovacs

Eduard Kovacs (@EduardKovacs) SecurityWeek’da katta boshqaruvchi muharrir. U 2011-yilda jurnalistika sohasida faoliyat boshlashdan oldin o‘rta maktabda IT o‘qituvchisi bo‘lib ishlagan. Eduard sanoat informatikasi bo‘yicha bakalavr darajasiga va elektr muhandisligida qo‘llaniladigan kompyuter texnikalari bo‘yicha magistr darajasiga ega.

Kundalik axborot byulleteni

Eng so‘nggi kiberxavfsizlik tahdidlari, tendentsiyalari va mutaxassis fikrlari haqida ma’lumot olish uchun SecurityWeek elektron pochta axborotiga obuna bo‘ling.

The original text is in EN, taken from the source site. Source ↗

Prince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations, according to Semperis.

The APT actor, also tracked as Infy, has been operating for close to 20 years. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe, and the Middle East.

Tomer Bar, AVP of security research at Semperis, tracked the group in his previous role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report, the hackers took a C&C server offline and later relocated the rest of their servers.

Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel, which broke out on February 28.

Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity.

Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim.Advertisement. Scroll to continue reading.

Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems.

In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot.

The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says.

“It is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes.

For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, home to thousands of domains, including legitimate sites and some operated by other threat actors.

“This is the last place we expected to find Prince of Persia hiding,” Bar said.

On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed.

Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic.

Related: In Rare Move, Alleged Iranian State Hacker Extradited to US

Related: US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.