Eron hukumati homiyligidagi “Fors shahzodasi” (Prince of Persia) tahdid guruhi bu yil o‘zining buyruq va nazorat (C&C) serverlaridan birini AQShdan ishga tushirdi — bu uning operatsiyalaridagi bir necha oylik tanaffusdan so‘ng sodir bo‘ldi, deb xabar berdi Semperis.
Infy nomi bilan ham kuzatiladigan ushbu APT aktyori deyarli 20 yildan beri faoliyat yuritmoqda. Uning nishonlari asosan eronlik dissidentlar, shuningdek AQSh, Yevropa va Yaqin Sharqdagi davlat va xususiy tashkilotlardir.
Semperisning xavfsizlik tadqiqotlari bo‘yicha AVPsi Tomer Bar o‘zining SafeBreach’dagi avvalgi lavozimida ushbu guruhni kuzatgan. Uning aytishicha, SafeBreach’ning 2026-yil fevral oyidagi hisobotidan bir hafta ichida xakerlar bitta C&C serverni o‘chirib, keyinchalik qolgan serverlarini boshqa joyga ko‘chirishgan.
Shundan so‘ng “Fors shahzodasi” operatsiyalarini uch oyga to‘xtatdi — bu uning deyarli yigirma yillik tarixidagi har qanday boshqa sukunatdan uzoqroq edi. Bu tanaffus Eron, AQSh va Isroil o‘rtasidagi urush bilan bir vaqtda sodir bo‘ldi, u 28-fevralda boshlangan.
Semperis SecurityWeek’ga ma’lum qilishicha, bu ular tasdiqlagan eng uzoq tanaffusdir, chunki tadqiqotchilar butun vaqt davomida guruh infratuzilmasini kuzatib borishgan. Avvalgi sukunat davrlari tadqiqotchilarning guruh operatsiyalarini ko‘rishidagi bo‘shliqlarni aks ettirgan, tasdiqlangan faoliyatsizlik emas.
“Fors shahzodasi” operatsiyalari 27-mayda yangi C&C server joylashtirilishi bilan qayta boshlandi va ma’lumotlar o‘g‘irlanishi tiklandi. Yetti kun ichida guruhning zararli dasturlar oilasidan biri bo‘lgan Tonnerre bitta qurbonchidan 1800 dan ortiq faylni o‘g‘irlab olgan.
Reklama. O‘qishni davom ettirish uchun pastga aylantiring.
Barning aytishicha, qurbonchilar soni hali ham kichik, bu guruhning yo maqsadli hujumlar o‘tkazayotgani, yo yangi tizimlarni buzishda qiynalayotganining belgisi bo‘lishi mumkin.
Avgust oyida Bar 7-iyulda qurilgan bo‘lishi mumkin bo‘lgan yangi serverni aniqladi, u Tornado’ning ikkinchi bosqichini qo‘llab-quvvatlaydi. Tornado — guruhning eng so‘nggi zararli dasturlar oilasi bo‘lib, uning imkoniyatlari Telegram bot orqali fayllarni o‘g‘irlashni o‘z ichiga oladi.
Barning aytishicha, server AQShda joylashgan bo‘lib, bu 2016-yildan beri guruhning mamlakat ichida C&C serverini joylashtirgan birinchi holatdir.
“Davlat homiyligidagi tahdid guruhlari uchun AQSh ichida bulut infratuzilmasi va veb-xosting provayderlaridan foydalanib C2 serverlarini yashirish odatiy hol emas, lekin bu tahdid aktyori uchun bu g‘ayrioddiy xatti-harakatdir,” deb ta’kidlaydi Bar.
Ushbu server uchun hujumchilar provayderlarni almashtirishdi. Ular shuningdek virtual xususiy serverlardan (VPS) voz kechib, Namecheap umumiy xostingini tanlashdi — bu minglab domenlar, jumladan qonuniy saytlar va boshqa tahdid aktyorlari tomonidan boshqariladigan ba’zi saytlar joylashgan joy.
“Bu “Fors shahzodasi”ni yashiringan holda topishni kutgan oxirgi joyimiz edi,” dedi Bar.
24-avgustda guruh Cloudflare ortida yashiringan Tornado’ning ikkinchi bosqich serverini o‘rnatishni boshladi. Semperis xakerlar AQShda joylashgan serverlari fosh bo‘lganini anglab yetgan deb gumon qiladi.
Semperis “Fors shahzodasi” infratuzilmasi bilan bog‘liq IoC’larni ulashgan. U tashkilotlarga ularni xavfsizlik vositalariga qo‘shishni va shubhali Telegram trafikini kuzatishni maslahat beradi.
Bog‘liq: Kamdan-kam uchraydigan harakatda, go‘yoki eronlik davlat xakeri AQShga ekstraditsiya qilindi
Bog‘liq: AQSh, Buyuk Britaniya va Niderlandiya agentliklari eronlik “Chosen Brick” kuzatuv zararli dasturini fosh qildi
Muallif: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek’da katta boshqaruvchi muharrir. U 2011-yilda jurnalistika sohasida faoliyat boshlashdan oldin o‘rta maktabda IT o‘qituvchisi bo‘lib ishlagan. Eduard sanoat informatikasi bo‘yicha bakalavr darajasiga va elektr muhandisligida qo‘llaniladigan kompyuter texnikalari bo‘yicha magistr darajasiga ega.
Kundalik axborot byulleteni
Eng so‘nggi kiberxavfsizlik tahdidlari, tendentsiyalari va mutaxassis fikrlari haqida ma’lumot olish uchun SecurityWeek elektron pochta axborotiga obuna bo‘ling.
Prince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations, according to Semperis.
The APT actor, also tracked as Infy, has been operating for close to 20 years. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe, and the Middle East.
Tomer Bar, AVP of security research at Semperis, tracked the group in his previous role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report, the hackers took a C&C server offline and later relocated the rest of their servers.
Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel, which broke out on February 28.
Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity.
Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim.Advertisement. Scroll to continue reading.
Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems.
In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot.
The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says.
“It is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes.
For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, home to thousands of domains, including legitimate sites and some operated by other threat actors.
“This is the last place we expected to find Prince of Persia hiding,” Bar said.
On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed.
Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic.
Related: In Rare Move, Alleged Iranian State Hacker Extradited to US
Related: US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
Written By Eduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Latest News
Hacker Conversations: Corey Thuen and the Evil Bit Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform Signal Vulnerability Lets Malicious Callers Block Hang-Ups Tech and Security Companies Respond to PHP2Shell Vulnerabilities Splunk, SolarWinds Release Fresh Security Updates Cisco Patches 34 Vulnerabilities Across Multiple Products PHP2Shell Exploitation Started Days Before Patches Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Cisco Patches 34 Vulnerabilities Across Multiple Products
PHP2Shell Exploitation Started Days Before Patches
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)