An Iranian APT’s command server turns up on American soil, researchers say
Three outlets reported within 48 hours that a state-linked Iranian group was running command-and-control infrastructure from a US host while targeting dissidents. The convergence is real; the sourcing behind it is one unnamed vendor report.
Iran International’s English service published “Iranian state-linked hackers used US server to target dissidents, researchers say” on 23 October, carried in syndication by Shabtab News the same day. SecurityWeek ran “Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016” on or about 23–24 October, and Infosecurity Magazine ran “Iranian Hacking Group Found Hosting C2 Infrastructure in the US” a day or so earlier. All three attribute the finding to researchers rather than to a government, and none names the originating vendor at headline level. The Files has not read the primary research report. Everything that normally makes a C2 story usable — the hosting provider, the number and geography of targets, the malware family, whether the server is still answering — is not established in what we were able to verify this cycle.
The one chartable claim is SecurityWeek’s “first time since 2016,” a ten-year gap in a group’s willingness to put its control infrastructure inside US jurisdiction. That figure appears in a trade-press headline, and trade headlines routinely sharpen vendor hedging into flat assertion; it needs checking against the research report’s own wording before anyone builds an argument on it. The adjacent pattern material is older and should not be blended in: Cybernews reported on about 17 September that Iranian actors were using Telegram-linked spyware, tracked as “Chosen Brick,” against dissidents, activists and journalists. That is five weeks outside this window and a different toolset. It establishes targeting intent, not continuity of infrastructure.
Assessment: Three outlets is not three sources. It is one vendor report refracted three ways, and the desk’s convergence test fails on provenance even when it passes on headcount. The substantive question is tradecraft economics: hosting control infrastructure inside the United States buys proximity to targets, reputable IP space and evasion of crude geofencing, at the cost of maximum legal exposure. A group that accepted that trade for the first time in a decade either judged the enforcement risk low or needed the access badly. Monday is the test. A server taken down within days is a routine story. A server still live is a much larger one, and it stops being about Tehran.