Press release · SemperisSummarised from the company's announcement. Not independently reported by IgniteIt Cybersecurity.
Semperis researcher Tomer Bar found the Iranian state-sponsored group Prince of Persia running command-and-control infrastructure in the US, the first such instance in about ten years, the company said.
The group, which went quiet in February, now uses shared hosting behind Cloudflare along with Telegram API channels, domain-generation algorithms and blockchain-based exfiltration. Semperis has published indicators of compromise and advised monitoring for unusual Telegram traffic.