Semperis says an Iranian state group ran command-and-control from US shared hosting
The vendor dates the discovery to August and the group’s return to 27 May, after a three-month silence it calls the longest it has confirmed. No US agency has said anything.
Semperis announced on 22 October that Tomer Bar, its AVP of security research, found the Iranian state-sponsored group tracked as Prince of Persia, or Infy, operating a command-and-control server on US shared hosting, a discovery made in August 2026. The firm says the group went dark on 28 February 2026, when the US and Israeli war with Iran began, resumed on 27 May with new infrastructure, and within one week of resuming extracted more than 1,800 files from a single victim, a figure SecurityWeek attributes to Semperis. The described tradecraft is a shift from European VPS hosting to US shared hosting to blend in with legitimate sites, a changed remote management panel, infrastructure behind Cloudflare, and use of Telegram API channels, domain-generation algorithms and blockchain-based exfiltration. Targets are primarily Iranian dissidents, plus entities in the US, Europe and the Middle East.
“What surprised me this time, however, was the threat actor’s decision to host the new C2 server for the first time in 10 years on U.S. soil, at the same time the conflict with the U.S. and Israel began,” Bar said. The claim carries a commercial release and no corroboration from CISA, the FBI or Israel’s national cyber directorate, and the write-ups differ on framing: the release says Bar found two instances of US-hosted infrastructure, in 2016 and this year, while SecurityWeek’s headline reads as “first time since 2016.” Separately, Group-IB and NyxLab disclosed on 23 October a campaign against exposed Fortinet FortiGate and Palo Alto GlobalProtect appliances that exposed more than 70,000 credentials, with victims split 38 percent Asia Pacific, 31.9 percent Latin America, 15.8 percent Europe and 12.7 percent Middle East and North Africa.
Assessment: Two vendor disclosures in two days, pulling in opposite directions. The Semperis finding is single-sourced and attribution-heavy; the useful part is not the flag but the hosting choice, which suggests a group optimising for blending into commodity infrastructure rather than for deniable geography. The silence from US agencies is the thread to pull: if a named state-sponsored C2 sat on American soil and nothing was seized, that is a story of its own. The Group-IB figures are the corrective. Their researchers describe k0t as enumerating exposed appliances at scale rather than researching organisations — so the 12.7 percent MENA share measures exposure, not targeting. Resist reading every regional number as intent.