An Iranian nation-state cyber threat group has been discovered using command-and-control (C2) servers based in the US to support its malware delivery and cyber-espionage campaigns.
The activity was identified by cybersecurity researchers at Semperis, who published their findings on October 22. The Iranian group is known as ‘Prince of Persia’, which has been active for around two decades.
Prince of Persia targets public and private sector organisations across the US, Europe and the Middle East, as well as dissidents and others opposed to the Iranian regime.
The multiple forms of malware used in Prince of Persia campaigns provide attackers with intrusive data exfiltration capabilities. This includes the ability to steal sensitive documents, as well as secretly taking screenshots and capturing audio recorded by the infected device.
Forms of malware identified as part of the latest Prince of Persia campaign include Foudre, a first stage malware loader and Tonnerre, a second stage malware which provides the attackers with what researchers describe as full surveillance capabilities.
The campaigns also involve a more recently identified malware known as Tornado, which builds on the codebase of previous malware. Tornado has the ability to use both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate network traffic to bypass firewalls and evade detection.
Advanced Anti-Detection Capabilities
Prince of Persia has been known to secretly hide its activity on European hosting services and virtual private servers, but anti-detection capabilities of the malware initially made it difficult for researchers to identify how the latest campaign was being hosted.
According to Tomer Bar, AVP of security research at Semperis, Prince of Persia seemed to go dark in February this year, coinciding with US and Israeli strikes against Iran.
“This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group,” said Bar.
However, information in the Tornado malware resulted in researchers being able to identify where the campaign was being hosted and it was found to be a US hosting company.
While it isn’t unusual for threat groups to hide their activity within US hosting providers, it is the first time an Iranian threat group has been identified as hosting their activity on US servers in at least 12 years.
“This is the last place we expected to find Prince of Persia hiding,” Bar added.
While Prince of Persia activity is highly targeted rather than widespread, the group has been a persistent cyber threat to organizations for almost two decades. To help ensure protection from attacks by the group, Semperis has recommended the following actions:
Ensure that your security controls are up to date
Monitor for any unusual Telegram traffic.
Ensure that your operating systems are fully updated
Click Here For The Original Source.
——————————————————–
