Skip to main content

Semperis finds Prince of Persia C2 server hosted in U.S.

Source Decision Insights Record Published October 22, 2026 Companies 2
Human View Machine View

2 companies named across 2 categories, one of 8 articles referencing Semperis. Previous coverage: Semperis earns Cohesity global security partner of the year (Oct 2026).

Companies mentioned

Best suited for

Seniority
Analyst
Job function
Cybersecurity / Security Analyst
Persona
Security Operations Practitioner
Buyer role
Technical Implementer / Administrator
Decision stage
How to start
Adoption curve
Early Majority
Technology maturity
Emerging Exploration
Industry
Information Technology / Cybersecurity / Security Operations / Threat Intelligence & Digital Risk Protection

Our classification, not the publisher's statement. Best suited for, not only for.

Semperis researcher Tomer Bar identified a command-and-control server run by Prince of Persia, an Iranian nation-state-sponsored threat group, in the United States. The finding points to a change in where the group hosts its infrastructure.

Prince of Persia had previously relied on European hosting and virtual private servers. Its activity went quiet after the conflict with the U.S. and Israel began on February 28, 2026. Recent victims are primarily Iranian dissidents.

After the pause, the group moved to shared hosting and altered its remote management panel. It began building new infrastructure behind Cloudflare, which left its operations alongside benign websites and infrastructure used by other threat actors. The group relies on Telegram API channels, domain-generation algorithms, and blockchain-based exfiltration to keep its C2 infrastructure resilient.

Bar has tracked the group for 10 years and identified the first two instances of Prince of Persia operating C2 servers in the U.S., in 2016 and this year. The newer server was discovered in August 2026. Organizations can protect their environments against these techniques by updating controls against the published IOCs, monitoring for unusual Telegram traffic, and fully updating operating systems.

“Prince of Persia went dark in February 2026 at the beginning of the conflict with the U.S. and Israel. This isn't unusual given that geopolitical conflict involving Iran leads to downtime with the threat group,” said Bar.

“What surprised me this time, however, was the threat actor's decision to host the new C2 server for the first time in 10 years on U.S. soil, at the same time the conflict with the U.S. and Israel began,” said Bar. “This is the last place we expected to find Prince of Persia hiding.”

Press release, provided by Cision on behalf of Semperis. Read the original.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "legalName": "Wiretap Labs, LLC",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/semperis-finds-prince-of-persia-c2-server-hosted-in-u.s./",
        "name": "Semperis finds Prince of Persia C2 server hosted in U.S.",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/semperis-finds-prince-of-persia-c2-server-hosted-in-u.s./#blogposting",
    "@type": "NewsArticle",
    "about": {
      "@id": "https://decisioninsights.ai/registry/semperis/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/semperis/",
      "name": "Semperis"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Emerging Exploration"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Security Operations / Threat Intelligence & Digital Risk Protection"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
      "@type": "Person",
      "name": "Decision Insights Record",
      "url": "https://decisioninsights.ai/author/decision-insights-signals/"
    },
    "dateModified": "2026-10-22T03:29:17-06:00",
    "datePublished": "2026-10-22T03:29:10-06:00",
    "description": "Semperis researcher Tomer Bar found Iranian threat group Prince of Persia running a U.S.-hosted command-and-control server, its first such server since 2016.",
    "headline": "Semperis finds Prince of Persia C2 server hosted in U.S.",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@type": "Organization",
        "name": "Cision"
      },
      "url": "https://www.prnewswire.com/news-releases/semperis-researcher-discovers-an-iranian-nation-state-sponsored-threat-group-operating-command-and-control-infrastructure-in-the-united-states-302916309.html"
    },
    "keywords": [
      "Server",
      "Threats"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/semperis-finds-prince-of-persia-c2-server-hosted-in-u.s./",
      "@type": "WebPage",
      "sdDatePublished": "2026-10-22",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/cloudflare/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/cloudflare/",
        "name": "Cloudflare"
      },
      {
        "@id": "https://decisioninsights.ai/registry/semperis/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/semperis/",
        "name": "Semperis"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
    "@type": "Person",
    "description": "Press releases and independent analyst research, structured into concise summaries for research and monitoring. Produced under our Standards & Methodology.",
    "name": "Decision Insights Record",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-signals/"
  }
]

Is this your company? Get structured data for your own pages