An Iranian state-sponsored hacking group used command-and-control infrastructure hosted in the United States this year after a months-long pause in operations, according to cybersecurity firm Semperis.
The group, known as Prince of Persia and also tracked as Infy, has operated for nearly two decades and has primarily targeted Iranian dissidents, along with government and private-sector organizations in the US, Europe and the Middle East.
Semperis researcher Tomer Bar said he identified a command-and-control server in the US in August, the first time the group had been found using US-based infrastructure since 2016.
Operations resumed after months-long pause
SecurityWeek, citing Semperis, reported that the group halted activity for about three months after the US-Israel war with Iran began on February 28.
Semperis said operations resumed on May 27, when the group deployed new infrastructure and restarted data theft. Within a week, one of its malware tools had extracted more than 1,800 files from a single victim, according to SecurityWeek.
Bar said the group’s victim count remained relatively small, which could indicate highly targeted operations or difficulty compromising new systems.
New infrastructure hidden among legitimate sites
Semperis said the group changed its hosting strategy after returning to activity, moving away from virtual private servers and instead using shared hosting in the United States.
The server identified in August was linked to Tornado, one of the group’s newer malware families, which can steal files through Telegram-based channels.
Bar said the use of US shared hosting was unusual for this particular group because it allowed the infrastructure to blend in with thousands of legitimate websites and other online services.
“This is the last place we expected to find Prince of Persia hiding,” he said.
Semperis also said the group later began building additional infrastructure behind Cloudflare, making its command-and-control systems harder to trace directly.
Iranian cyber activity under growing scrutiny
The findings come as US authorities and cybersecurity researchers continue to report Iranian-linked cyber activity targeting both dissidents and critical infrastructure.
In September, NBC News reported that Iranian hackers had recently targeted US water, telecommunications and energy systems, citing government and industry cyberthreat sources. Those attempts had not caused major disruption.
US prosecutors have also pursued cases against alleged Iranian hackers accused of working on behalf of state institutions.
Last month, Montenegro approved the extradition of Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over an alleged campaign targeting universities and research institutions for entities including the Revolutionary Guards.
US prosecutors say that broader campaign compromised thousands of academic accounts and resulted in the theft of more than 31 terabytes of data.
A man accused of plotting attacks on Iran International journalists told a London court on Thursday that his Iranian handlers had instructed him to break one journalist’s arms and legs and assault another to stop him from criticizing the Islamic Republic.
Mostafa Sepahvand told Woolwich Crown Court that he had been asked to attack Iran International journalists Kambiz Hosseini and Mojtaba Pourmohsen, as well as two other people, Alon Farago and Jonathan Turner.
Asked by prosecutor Emlyn Jones what those behind the alleged operation wanted him to do, Sepahvand replied: “To hit them.”
“They asked me to hit Jonathan and scare him off; they asked me to break Kambiz's arms and legs; they asked me to hit Pourmohsen to stop him writing about the regime,” he said.
Sepahvand, 41, is on trial alongside Farhad Javadi Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain's National Security Act.
Prosecutors say the men gathered information for Iranian intelligence in preparation for serious violence against people critical of Tehran.
Sepahvand acknowledges conducting surveillance but says he only appeared to cooperate because of threats against him and his family and never intended to hurt anyone. Instead, he says, he deliberately tried to frustrate the operation.
“I played them,” he has repeatedly told the court.
Prosecutors challenge his account
Cross-examining Sepahvand on Thursday, Jones directly challenged that defense, suggesting his claims that he had been deceiving the Revolutionary Guards were explanations invented after his arrest.
“What I am suggesting is that every time you said ‘I was playing the IRGC,’ you were lying,” Jones said.
“No, that was not the case,” Sepahvand replied.
The prosecution questioned Sepahvand about visits he made to addresses he had been given and photographs and videos taken during the alleged surveillance.
Sepahvand acknowledged going to an address associated with Pourmohsen and taking a photograph, but denied that he was preparing an attack.
“I go there, I get a picture, I go back home,” he said. “They ask me to hit them, I play them.”
Jones argued that Sepahvand's repeated visits, searches and complaints about inadequate information showed that he was carrying out groundwork for the alleged attacks rather than trying to sabotage them.
Sepahvand insisted that he deliberately told his contacts that addresses were wrong, exaggerated the difficulty and expense of finding the targets and repeatedly delayed carrying out their instructions.
He said that had he encountered the journalists, he would have warned them. “If I saw them I'd tell them that IRGC was after them and you have to escape,” he told the court.
£150,000 demand questioned
Jones also challenged Sepahvand over his repeated demands for money, including messages in which he said he would complete the job for £150,000.
Sepahvand said the demands were another delaying tactic because money was a “weak spot” for the people directing him.
“If I wanted to accept the money, I would have accepted £30,000,” he told the court, referring to a smaller payment discussed earlier in the alleged operation.
Jones questioned why Sepahvand would have been in a position to demand payment if, as he maintains, he had agreed to cooperate only because Iranian operatives were threatening him and his family.
Sepahvand said he had told them he would need a team and money to carry out the attacks but maintained that he never intended to do so.
“They wanted to force me and I didn't do it,” he said.
Sepahvand became increasingly agitated during the cross-examination, repeatedly raising the case of Navid Imami, a man he says was connected to the Iranian embassy in London and had supplied information about the targets.
The judge called a break after Sepahvand repeatedly interrupted Jones and later warned him that if he continued shouting or repeating his defense rather than answering questions, the jury could conclude that he did not have answers to the prosecution's case.
Sepahvand testified Wednesday that he had met Imami at the Iranian embassy in February 2025 while the alleged operation was under way.
He maintains that pressure on members of his family in Iran forced him to maintain contact with the people directing the operation and that his apparent cooperation was intended to protect others without carrying out the attacks.
The prosecution's cross-examination of Sepahvand is due to continue when the trial resumes Monday.
Germany’s financial regulator BaFin said on Thursday that Bank Saderat Iran’s Hamburg branch had lost its banking license and must be wound up. The branch, which operated in Hamburg and Frankfurt, is no longer allowed to conduct banking business.
BaFin revoked the license on November 5, 2025, citing persistent legal violations that the bank had failed to remedy. A 2023 special audit found serious shortcomings in its business organization, and the bank had been inactive for more than six months.
BaFin also cited sanctions against the institution, saying German banking law therefore presumes its managers to be unreliable, regardless of whether they personally engaged in misconduct.
BaFin orders branch wound up
BaFin ordered the wind-down on June 11, 2026. The liquidation order became final on July 15, according to the regulator. The bank later withdrew legal action against the measure on September 23, and a Hamburg court appointed Berlin-based FUW Treuhand Project Management GmbH as liquidator on September 30.
The withdrawal of the banking license had already become final on December 8, 2025.
The bank mainly handled and financed Iran-related exports, including payment services, letters of credit, lending, guarantees and investments. It had 13 employees and assets of €62.4 million at the end of 2025. Customer deposits total about €200,000.
Deposits remain subject to sanctions restrictions
BaFin said there is currently no deposit compensation event, meaning Germany’s deposit guarantee system has not been triggered. Access to funds is restricted under EU sanctions, however, and the liquidator can make payments only with authorization from the Bundesbank’s Financial Sanctions Service Center.
BaFin said the existing deposits would instead be dealt with as part of the liquidation of the branch.
Iranian banks remain under scrutiny in Germany
The decision comes as Iranian banks operating in Germany face heightened scrutiny under renewed EU sanctions and increased US pressure on Tehran’s overseas financial network.
Bank Melli Iran’s Hamburg branch remains open despite being covered by EU sanctions, Germany’s Foreign Ministry told Iran International in August.
The ministry said at the time that the sanctions applied to Bank Melli and its German branch, but did not say whether Berlin was considering closing the operation.
The issue gained attention after US Treasury Secretary Scott Bessent launched “Operation Economic Outcast” and called for every Bank Melli branch abroad to be shut. Germany said it remained in contact with Washington and other partners over further measures against Iran but gave no indication that a decision had been made on Bank Melli’s Hamburg branch.
Bank Melli and Bank Saderat are separate institutions, and BaFin’s action against Bank Saderat was based on German banking-law requirements as well as the sanctions applying to the bank.
A man accused of plotting an attack on Iran International journalists told a London court Wednesday that he met an alleged Revolutionary Guards contact at the Iranian embassy while he was gathering information on the journalists.
Mostafa Sepahvand told Woolwich Crown Court that he visited the embassy on February 15, 2025, where he met a man he identified as Navid Emami.
Sepahvand said he told Emami that addresses provided for the journalists were incorrect but that he was still pursuing the matter. According to Sepahvand, Emami asked whether his co-defendant Farhad Javadi Manesh was working with him.
Later in his testimony, Sepahvand said Emami had supplied addresses to people he described as connected to the Revolutionary Guards. He also alleged that Emami had threatened him.
Sepahvand, 41, is on trial alongside Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain's National Security Act.
Prosecutors say the men gathered information for Iranian intelligence in preparation for serious violence against Iran International journalists Mojtaba Pourmohsen and Kambiz Hosseini.
Sepahvand accepts that he conducted surveillance but says he acted under duress and deliberately tried to undermine the operation.
The court was shown phone and vehicle location data placing Sepahvand near addresses linked to the alleged targets, as well as messages in which he passed Manesh information about Hosseini, including references to his dog and a blue Volkswagen Golf.
Sepahvand said he asked Manesh to make a video of the car. On one occasion, he said, he travelled to an address specifically so his phone's GPS would show his Iranian contacts that he had been there.
He said he was trying to convince the Revolutionary Guards that he was cooperating while actually frustrating the alleged operation.
“I played them,” Sepahvand told the court.
Sepahvand also testified that £30,000 had been sent to a money exchange in Finchley after an address linked to Pourmohsen was raised, but said he did not collect it because he did not want to carry out the task.
Asked who had sent the money and what it was for, Sepahvand named a man called Ruhollah and said it was to “go after the journalists.” Asked which journalists, he said that had not been specified.
Sepahvand said he had initially asked for £150,000. When he denied telling his Iranian contacts that he would attack a journalist if they paid him, his barrister, Tyrone Smith, pointed him to an earlier message in which he appeared to say he would carry out the attack if paid.
Sepahvand said he had no choice but to make such claims because he believed the Revolutionary Guards were monitoring his communications and waiting for him to say he would not carry out the attack.
He said he had been under duress from the beginning, citing the arrest of an associate and his younger brother, a raid on his mother's home and pressure over a criminal case against him in Iran.
“I didn't want anyone to be hurt,” Sepahvand said toward the end of his testimony. “I wanted to protect everyone.”
The trial continues.
Israel has barred a United Airlines pilot of Iranian descent from serving on flights to the country over unverified social media allegations that he supported Iran's government, the Revolutionary Guards and Hezbollah, Ynet reported Wednesday.
Israel's Diaspora Affairs and Combating Antisemitism Ministry alerted security and transportation officials on October 19 to allegations circulating on X about the pilot, Sina Amjadian, according to a ministry letter obtained by Ynet.
The letter included two posts from X. One alleged that Amjadian, who was said to have previously worked for flydubai, had shared content supporting Iran's government, including a video in which he purportedly kissed and saluted its emblem.
The other alleged that he had expressed support for the Islamic Revolutionary Guard Corps and Hezbollah and called on United Airlines to investigate his conduct.
Ynet said it could not independently verify the allegations and that the material submitted to Israeli authorities did not include original statements or social media posts by Amjadian.
The allegations nevertheless prompted a security review and a decision to prohibit Amjadian from serving as a crew member on flights to Israel, senior Transportation Ministry officials told Ynet.
The Diaspora Affairs Ministry said the warning followed an attempted attack aboard a flydubai flight bound for Israel in late September, during which a co-pilot attacked the captain and attempted to seize control of the aircraft.
The incident prompted Israel's National Command and Control Center for Combating Antisemitism to expand its monitoring to people who might pose a threat to aviation security, according to the ministry.
It said the allegations concerning Amjadian warranted security scrutiny because of the responsibilities of an international airline pilot and the potential risks to passengers and crew.
Transportation Ministry officials told Ynet that the ministry did not independently monitor social media or gather intelligence but coordinated with security agencies when information raised aviation safety concerns.
They said preventing a pilot from operating flights to Israel was separate from denying the individual entry to the country, which falls under the authority of border control officials.
Ynet said it remained unclear whether Amjadian had previously flown to Israel, had been scheduled to operate a flight to Ben Gurion Airport or was qualified to fly aircraft used by United Airlines on its Israel routes.
There was no indication that any flight had been canceled or prevented from reaching Israel because of the restriction.
Conflicting accounts emerged Wednesday over Iraq's plans for its border with Iran, as Baghdad attributed the closure of one major crossing to technical shortcomings while reports said more could be shut amid US pressure to restrict trade routes with Tehran.
Iraqi government spokesperson Haider al-Aboudi said the Sheeb crossing, known as Chazabeh in Iran, was closed because it lacked sufficient technical, technological and developmental readiness, according to the official Iraqi News Agency.
He said trade was proceeding normally through several other crossings with Iran.
But Al Jazeera cited an Iraqi government official on Tuesday as saying Prime Minister Ali al-Zaidi had ordered Sheeb closed indefinitely and several other crossings gradually shut in the coming days. No reason was given for the planned closures.
Separately, AFP reported Wednesday, citing two Iraqi political sources, that Washington was pressing Baghdad to close crossings with Iran as part of efforts to increase economic pressure on Tehran.
One source said the US Treasury Department raised the issue with Zaidi during his visit to New York for the UN General Assembly last month and that the proposed restrictions would leave only two crossings open, one in federal Iraq and another in the Kurdistan region.
The second source said Washington had asked other countries bordering Iran to take similar measures.
Reuters reported that Sheeb had been closed to passengers, vehicles and commercial trucks. An Iraqi border official told the agency the closure would allow security arrangements to be reviewed and detection equipment installed to prevent the smuggling of prohibited materials.
Tehran seeks reopening
Iranian officials said they had received no advance warning of the closure.
Valiollah Hayati, a security official in Iran's southwestern Khuzestan province, said consultations were under way with Iraqi authorities to reopen Sheeb and advised passengers and commercial trucks to use the nearby Shalamcheh crossing.
Iranian Interior Ministry spokesperson Ali Zeinivand said Iraq was required to notify Tehran of extended border closures but had not done so.
Foreign Minister Abbas Araghchi also criticized disruptions at Iran's borders on Wednesday, saying they had become places where traffic was held up rather than allowed to pass. He said the Foreign Ministry would seek to resolve obstacles originating in neighboring countries.
The uncertainty comes days after Pakistan suspended commercial activity at two major crossings with Iran, Taftan-Mirjaveh and Gabd-Rimdan, on October 17.
Iranian authorities said the border reopened on Tuesday, although the resumption of normal commercial traffic at both crossings has not been independently confirmed.
Iran and Iraq share a border of more than 1,400 kilometers (870 miles) and have extensive political, religious and economic ties.
