Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Summary
The Iranian threat actor group known as Prince of Persia has established a command and control (C&C) server within the United States. This marks the first time since 2016 that the group has utilized US-based infrastructure for their C&C operations, following a three-month period of inactivity.
IFF Assessment
The activity of an advanced persistent threat group establishing infrastructure in a new region, especially for command and control, poses an increased risk to targets in that region.
Defender Context
This development signifies a shift in tactics for a known Iranian APT group, potentially indicating an increased focus on targets within the US or a move to evade existing detection mechanisms. Defenders should be vigilant for network traffic originating from or communicating with US-based infrastructure that exhibits characteristics of this threat actor's TTPs.