Security researchers cited by SecurityWeek say the Iran-linked Prince of Persia advanced persistent threat group has resumed activity after roughly three months of reduced visibility. According to the report, the group hid a Tornado command-and-control server on US shared hosting infrastructure, described as its first known US-based server since 2016.

While the reported change concerns attacker infrastructure rather than a newly disclosed breach, it is relevant for businesses because command-and-control systems are used to manage compromised machines, move data and maintain access during intrusions. Hosting such infrastructure on mainstream or geographically familiar providers can make malicious traffic blend in more easily with normal web activity.

What happened

According to the SecurityWeek report, researchers observed the Prince of Persia group using a US-hosted command-and-control server after a period of apparent inactivity. The article indicates this is the first time since 2016 that the group has been seen placing this type of infrastructure in the US.

The report does not by itself mean that European companies are being directly targeted in this specific campaign. However, it does indicate a shift in operational setup by a known state-linked threat actor, and such changes are closely watched because they can affect detection, blocking and threat hunting.

Why it matters for European businesses

For European organisations, the practical issue is not the server location alone, but what it suggests about how attackers adapt. Many security teams still use geography, hosting reputation and infrastructure familiarity as supporting indicators when filtering suspicious traffic. If threat actors increasingly use ordinary shared hosting in trusted regions, those signals become less reliable on their own.

This has several business implications:

• Detection may become harder: traffic to a well-known hosting environment may not immediately look suspicious.
• False assumptions can create risk: companies should not assume that US- or EU-hosted infrastructure is inherently safe.
• SMEs may be more exposed: smaller organisations often depend on default protections from firewalls, endpoint tools and hosting providers rather than dedicated threat hunting.
• Managed service providers and digital agencies should take note: businesses responsible for multiple customer websites, cloud systems or email environments may need to review monitoring rules across their client base.

The broader lesson is that attacker tradecraft continues to evolve in ways that can reduce the value of simple allowlists, basic IP reputation checks or country-based network trust decisions.

Who may be affected

The report is most relevant to organisations that rely on internet-facing systems or manage multiple digital assets, including:

• SMEs with limited in-house security monitoring
• IT teams responsible for endpoint, cloud and network security
• Digital agencies and managed service providers supporting client infrastructure
• E-commerce companies handling customer accounts, payments or order systems
• Businesses in regulated sectors that need stronger logging, incident response and supplier oversight

Even if a company is not a likely direct target of a state-linked actor, the same infrastructure techniques can influence the wider threat landscape. Methods first seen in advanced campaigns often appear later in financially motivated attacks, phishing operations or malware distribution.

What companies should consider

Based on the limited public information in the report, businesses should avoid overreacting to one infrastructure observation. However, it is a sensible prompt to review whether existing controls depend too heavily on IP location or hosting reputation.

• Review network detection rules: make sure monitoring does not treat traffic as low risk simply because it originates from reputable shared hosting or familiar regions.
• Strengthen endpoint visibility: endpoint detection and response tools can help identify suspicious process activity even when network indicators are weak.
• Check DNS and outbound traffic monitoring: unusual connections from servers or employee devices to rarely used hosts should be investigated.
• Update threat intelligence feeds carefully: use current intelligence from trusted vendors, but do not rely only on static blocklists.
• Test incident response readiness: ensure teams know how to isolate compromised systems, preserve logs and escalate suspicious activity.
• Ask suppliers about monitoring: companies using managed hosting, MSPs or security providers should confirm how anomalous outbound traffic and command-and-control behaviour are detected.

For European businesses, the key takeaway is straightforward: sophisticated attacker infrastructure can now sit on ordinary hosting platforms in trusted locations. Security controls should therefore focus on behaviour, context and layered detection rather than assumptions about where traffic is hosted.