Iran’s two main mobile operators raise internet tariffs by up to 40%

The group, known as Prince of Persia and also tracked as Infy, has operated for nearly two decades and has primarily targeted Iranian dissidents, along with government and private-sector organizations in the US, Europe and the Middle East.

Semperis researcher Tomer Bar said he identified a command-and-control server in the US in August, the first time the group had been found using US-based infrastructure since 2016.

Operations resumed after months-long pause

SecurityWeek, citing Semperis, reported that the group halted activity for about three months after the US-Israel war with Iran began on February 28.

Semperis said operations resumed on May 27, when the group deployed new infrastructure and restarted data theft. Within a week, one of its malware tools had extracted more than 1,800 files from a single victim, according to SecurityWeek.

Bar said the group’s victim count remained relatively small, which could indicate highly targeted operations or difficulty compromising new systems.

New infrastructure hidden among legitimate sites

Semperis said the group changed its hosting strategy after returning to activity, moving away from virtual private servers and instead using shared hosting in the United States.

• 

  Freeway sign hack aims to frighten Iranians in Los Angeles, experts say

• 

  Iranian hacker in IRGC-linked cyber case to be extradited to US

• 

  Iranian hackers targeted US infrastructure in recent weeks - NBC News

The server identified in August was linked to Tornado, one of the group’s newer malware families, which can steal files through Telegram-based channels.

Bar said the use of US shared hosting was unusual for this particular group because it allowed the infrastructure to blend in with thousands of legitimate websites and other online services.

“This is the last place we expected to find Prince of Persia hiding,” he said.

Semperis also said the group later began building additional infrastructure behind Cloudflare, making its command-and-control systems harder to trace directly.

Iranian cyber activity under growing scrutiny

The findings come as US authorities and cybersecurity researchers continue to report Iranian-linked cyber activity targeting both dissidents and critical infrastructure.

In September, NBC News reported that Iranian hackers had recently targeted US water, telecommunications and energy systems, citing government and industry cyberthreat sources. Those attempts had not caused major disruption.

US prosecutors have also pursued cases against alleged Iranian hackers accused of working on behalf of state institutions.

Last month, Montenegro approved the extradition of Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over an alleged campaign targeting universities and research institutions for entities including the Revolutionary Guards.

US prosecutors say that broader campaign compromised thousands of academic accounts and resulted in the theft of more than 31 terabytes of data.

In September, China imported just 276,000 barrels per day of oil recorded as Malaysian, down from an average of nearly 1.3 million barrels per day in 2025.

In some previous months, the figure had reached 2 million barrels per day. That is roughly four times Malaysia's total oil production.

Much of the discrepancy may reflect oil coming from Iran but recorded by China's customs as originating in Malaysia, alongside sanctioned oil from other producers and genuine Malaysian exports.

Chinese customs authorities have consistently reported zero monthly imports of Iranian oil since 2020. Yet tanker-tracking companies estimate that Iran delivered an average of around 1.5 million barrels per day to China last year.

Sanctions and blockade

Kpler previously told Iran International that most Iranian oil exports to China are recorded as Malaysian, while some cargoes are declared as originating from Iraq, Oman and even the United Arab Emirates. TankerTrackers has also documented the practice.

The decline in China's recorded Malaysian imports has accelerated as US sanctions have tightened and the naval blockade has choked off Iranian exports.

Kpler data obtained by Iran International show that Iran delivered more than 1.55 million barrels per day of oil to China between January and May this year. From June through September, the average fell to less than half that level.

By mid-October, the volume of Iranian oil afloat outside the US blockade line had fallen to zero.

If current trends persist, China's imports of oil recorded as Malaysian could fall to their lowest level in years, potentially approaching the 2017 level of just 130,000 barrels per day as early as this month or next.

Alternative suppliers

While Iranian oil exports have collapsed, tanker-tracking data show that overall oil exports from the Middle East have recovered to prewar levels and even surpassed them.

The Wall Street Journal, citing Kpler data, reported that the region's exports of oil and petroleum products have reached 24 million barrels per day, above the level recorded before the war.

Before the war, more than 80% of the oil passing through the Strait of Hormuz was destined for Asian markets, with China the largest buyer.

Chinese customs data show that in September, China imported an average of 2.9 million barrels per day from Oman, the United Arab Emirates, Qatar, Saudi Arabia and Iraq, up from less than 2 million barrels per day in May.

The figure nevertheless remained below February's prewar level, when China's combined imports from those five countries exceeded 3.8 million barrels per day.

The numbers also reflect a broader shift in Chinese oil buying after the outbreak of war. As global prices surged, China at one point cut overall crude imports by around 30% and drew instead on its strategic petroleum reserves.

In that sense, China acted as a significant shock absorber, helping limit an even sharper increase in global oil prices.

Before the war, China imported around 11.5 million barrels per day of crude. Following the US-Israeli war on Iran and disruption of traffic through the Strait of Hormuz, imports fell to around 8 million barrels per day before recovering more recently to above 9 million.

The shift suggests that China is increasingly replacing lost Iranian barrels with oil from other Middle Eastern producers. The disappearance of China's “Malaysian” imports is yet another measure of how sharply the blockade has curtailed Iran's access to its most important oil market.

For the first time, Turkey, Saudi Arabia, Egypt and Pakistan will meet Britain, France and Germany for security-focused talks. The meeting comes as attacks on ships and regional energy infrastructure continue and oil prices have reached their highest level in five months.

The Istanbul meeting could mark a shift from regional consultations toward broader security coordination. It follows months of efforts by regional states to build cooperation against threats from the Islamic Republic, particularly attacks by the Iran-backed Houthis.

Turkey, Saudi Arabia and Pakistan — the three members of the Mecca defense pact — will all attend and have committed to using their military capabilities to defend Saudi Arabia. Egypt is also considering military support for Riyadh.

The three European powers are now joining the talks with concerns of their own, particularly over energy.

The platform could lead to a form of division of labor in the Iran war, operating in parallel with US and Israeli military pressure on the Islamic Republic and focused primarily on containing the Iran-backed Houthis.

From regional consultations to defense cooperation

Turkey, Egypt, Pakistan and Saudi Arabia have held regular consultations since March following Houthi threats in Bab al-Mandab. The grouping has become known as the R4.

The four countries have emphasized direct regional involvement in resolving crises and in recent months have adopted common positions on the Iran war, Palestine and Saudi security.

Alongside these diplomatic efforts, Turkey, Saudi Arabia and Pakistan have expanded defense cooperation through the Mecca pact. Under the agreement, an external armed attack on one member is considered an attack on all three.

Officials from the three countries agreed on August 31 to establish a joint secretariat and expand defense cooperation. Their defense committee decided on October 5 to make agreed forces and military capabilities available for rapid deployment to Saudi Arabia.

The four R4 countries also condemned Iran-backed Houthi attacks on Saudi Arabia in an October 11 statement and backed Riyadh’s measures to counter the threats.

Turkey is meanwhile pursuing parliamentary approval of the Mecca pact, while Egypt’s parliament is due to decide on Monday, October 26, whether to deploy forces in military support of Saudi Arabia. Egypt is not a member of the pact, but the prospect of it joining is being seriously considered.

Despite these developments, the countries continue to emphasize a diplomatic solution to the Iran-US war, and some remain in contact with Tehran.

While seeking to prevent the war from spreading, they are also moving closer to joint defensive action against Iran-backed Houthi attacks. These parallel efforts could help contain the crisis and pave the way for a new regional security arrangement, but could also draw the countries deeper into the war and create domestic political tensions.

Containing the Iran-backed Houthis on a parallel track

Protecting critical infrastructure is a central priority for Saudi Arabia in its cooperation with Turkey and Pakistan.

Iran-backed Houthi attacks on Saudi economic and military facilities and insecurity in Bab al-Mandab have caused direct damage while putting pressure on the kingdom’s energy exports and investment plans.

Strengthening Saudi Arabia’s defensive capabilities could reduce some of that vulnerability. But the impact of the new cooperation may extend beyond protecting Saudi facilities.

Saudi defenses against such attacks currently depend on direct US support. A greater role for Turkey and Pakistan, combined with coordination among the four regional countries, could reduce that dependence and allow Washington to devote more resources and attention to the Iran war.

From this perspective, two parallel tracks are taking shape. The United States and Israel are pursuing direct military pressure on Iran, while the countries represented in Istanbul are cooperating to contain the regional consequences of the war.

The two tracks, however, do not constitute a single coalition. Despite their political and security ties with the United States, the regional countries have avoided joint arrangements with Israel, preventing the two approaches from becoming fully integrated.

Cooperation with Washington does not necessarily mean participation in Israel’s strategy. These countries can oppose an expansion of the war against Iran while acting to contain threats arising from it, particularly Houthi attacks.

The practical result could be a form of division of labor even without a formal agreement between the US-Israel camp and the R4.

Iran’s leverage and the risk of diminished influence

The emerging arrangement has particular significance for Iran. If the cooperation succeeds and takes on a military dimension, it would amount to action against an ally of Tehran.

For now, Iran is seeking to raise the cost of continuing the war for the United States and regional countries by leveraging its geographic position in the Strait of Hormuz and its support for the Houthis. Tehran has also promised to respond to actions against its interests.

Alongside maintaining these forms of leverage, Tehran is using diplomacy in an effort to turn them into political gains.

Iranian Foreign Minister Abbas Araghchi has said a seven-day proposal for restoring normal shipping through the Strait of Hormuz was conveyed through Qatar, with implementation conditional on Tehran’s demands being met.

On Yemen, he has said Iran is prepared to mediate between Saudi Arabia and Ansarullah while rejecting the assertion that the Houthis take direct orders from Tehran.

The two positions indicate that Tehran wants to preserve its ability to turn regional pressure into political leverage. Continued pressure, however, could produce a different outcome.

Governments facing attacks on infrastructure and disruption to maritime routes are moving toward closer defense cooperation to reduce their vulnerability, potentially increasing their capacity to confront Iran.

Crucially, reducing the impact of regional pressure does not necessarily require the military defeat of Iran-aligned forces.

If Saudi Arabia can better protect its infrastructure with help from new partners and the threat to shipping in Bab al-Mandab diminishes, part of Tehran’s bargaining power would be reduced.

Its leverage in the Strait of Hormuz would not be directly affected by these arrangements and would remain in Tehran’s hands, though it could become more fragile than before. Much will depend on Tehran’s response to actions taken by the countries participating in the platform.

Ansarullah, however, is an actor with demands of its own, and ending the Yemen war would require a separate agreement.

Continued contacts between Turkey, Pakistan and Egypt and Tehran also indicate that these governments still see a role for the Islamic Republic in reducing tensions. Anadolu Agency has reported that Pakistan’s army chief asked Tehran to use its influence to halt Houthi attacks on Saudi infrastructure.

Europe and the future of regional security

The involvement of Britain, France and Germany could broaden the scope of this emerging cooperation.

Their involvement reflects concerns about the wider consequences of the war, disruption to shipping through the Strait of Hormuz and, above all, energy supplies.

The European countries are joining the R4 states in an effort to address those concerns, but their involvement would also increase NATO’s presence in the region and could potentially lead to an expanded military role.

For Turkey, hosting the meeting provides an opportunity to strengthen its position in regional diplomacy. Saudi Arabia can combine the defensive support of regional partners with broader European consultations.

The European countries, meanwhile, are engaging governments that cooperate with the United States while maintaining political access to Tehran, allowing them both to maintain channels with Iran and signal their opposition to its actions.

Continued European engagement with the R4 could produce a multilayered structure linking political cooperation among the four regional countries, the defense commitments of three of them and diplomatic coordination with Europe.

Such a structure would not immediately replace the US presence and would not necessarily align with Israel’s strategy, but it could give regional countries a larger role in managing crises — a role Turkish President Recep Tayyip Erdogan has strongly pursued.

From this perspective, the Istanbul meeting may signal an emerging division of labor between two parallel tracks: US and Israeli military pressure on Iran on one side, and efforts by regional countries, with European participation, to contain Tehran’s regional proxies on the other.

While such cooperation could help reduce tensions, it also carries the risk of widening the war — a shared concern that has made all sides cautious about taking major military action.

The freezing of some $350 million in Iranian cryptocurrency and a US maritime blockade that Washington says has prevented at least $25 billion in Iranian oil exports highlight the pressure on Tehran’s finances.

“Cryptocurrency is not really a method for a central bank or for a country’s trade,” said Maleki, a senior fellow at the Foundation for Defense of Democracies and former executive at the US Treasury Department’s Office of Foreign Assets Control.

Maleki said cryptocurrency was better suited to relatively small transactions and transfers, while blockchain transactions could be traced.

“You can see on the blockchain where it came from and where it went,” he said.

Iran has turned to cryptocurrency as economic pressure has narrowed its options, Maleki said, adding that such transactions can be traced and the funds blocked.

Oil revenue dries up

The larger problem for Iran is the loss of oil revenue.

US Central Command commander Admiral Brad Cooper said Thursday that the maritime blockade had prevented Iran from exporting at least $25 billion worth of crude oil over 100 days.

Iran initially continued selling oil that had left the Strait of Hormuz before the blockade and remained aboard tankers in international waters.

Those floating reserves were depleted by mid-October, the Wall Street Journal reported Wednesday, citing analysts at commodity-data firm Kpler.

“There’s no more oil to discharge to China anymore,” Kpler’s head of crude oil analysis Homayoun Falakshahi told the Journal.

“The economic clock of the Islamic Republic has basically stopped,” Maleki said, arguing that Tehran no longer has access to the oil income it previously used to finance imports.

Imports pose the next test

Some goods now entering Iran were paid for earlier, while other imports are continuing through land routes, Maleki said.

The greater pressure will come when Tehran has to finance new purchases and transportation costs without the oil revenue it previously relied on.

“When they can no longer pay the cost of buying and transporting the goods they are now importing over land, that is when the problems will become much more difficult for the Islamic Republic,” Maleki said.

He cautioned that it was difficult to determine how quickly that point would be reached.

“I can’t give you a number of days or weeks,” he said.

Maleki said cryptocurrency was suitable for limited transfers, while the loss of oil revenue would make it harder for Iran to pay for imports.

Maleki said it was difficult to estimate in days or weeks when the loss of revenue would translate into more severe economic pressure.

Although Washington has not declared a land blockade of Iran, the closure of crossings with Pakistan and Iraq and continued disruption to freight traffic at the Turkish border have raised alarm in Tehran.

Mohsen Rezaei, secretary of Iran’s Supreme National Security Council, acknowledged in an interview with Drop Site published Thursday that Iran would suffer from a prolonged blockade.

“Anyone who says otherwise is not being realistic. Families will pay the price, investment will suffer, and maintaining some sectors of the economy will become more difficult,” he said.

But Rezaei argued that economic pain did not amount to strategic defeat and that Washington was wrong to believe worsening conditions would force Tehran to accept US demands.

Agence France-Presse reported Wednesday that the United States was pressing Iran’s neighbors to close border crossings, following a maritime blockade in southern Iran and air restrictions that have grounded most Iranian flights.

President Masoud Pezeshkian has said the maritime blockade has halted trade through southern sea routes, which previously accounted for 75% to 80% of Iran’s trade.

Pakistan: transit disputes

Iran has responded cautiously to Pakistan, which has been mediating between Tehran and Washington.

Foreign Ministry spokesman Esmaeil Baghaei attributed the suspension of operations at border crossings to “technical problems” on the Pakistani side and said the two countries were discussing reopening them.

After the US maritime blockade took effect, Iranian traders increasingly used Pakistani ports as alternative routes.

But tighter requirements for electronic bills of lading and difficulties transferring money have complicated trade, according to Peyman Sanandaji, a senior official at the Tehran Chamber of Commerce.

Pakistan closed the Rimdan–Gabd and Taftan crossings on Tuesday during a visit to Tehran by Pakistani Army Chief Asim Munir, citing security concerns and efforts to prevent smuggling.

Iranian officials said Munir ordered the crossings reopened during his visit, but the latest reports indicated Pakistan was allowing only Iranian gas tankers and perishable fruit and vegetable shipments to pass.

Fada-Hossein Maleki, head of the Iran-Pakistan parliamentary friendship group, warned Thursday that Iran could close its border if Islamabad continued preventing trucks from crossing.

Such a move could also hurt Pakistan, which uses Iranian territory to move some exports toward Turkey, Central Asia and the Caucasus and receives millions of liters of Iranian gasoline and diesel through official trade and smuggling.

Iraq: conflicting signals

Iraq has not announced a general closure of its border with Iran. But Al Jazeera reported that the Chazabeh–Al-Shaib crossing was closed Wednesday on the direct orders of Prime Minister Ali al-Zaidi and that further crossings were expected to shut.

Abdul Amir Taiban, an adviser to Iraq’s prime minister, said Thursday that Chazabeh had been closed to prevent the entry of drugs and counterfeit dollars and dinars.

He accused Iran of undermining Iraq’s economy, smuggling drugs and violating Iraqi sovereignty.

Iran and Iraq have 13 official border crossings, several of them major routes for exports and commercial traffic, particularly with central and southern Iraq.

Iraq temporarily closed its crossings with Iran a month earlier after a drone attack on Saudi Arabia’s east-west pipeline from Iraqi territory was attributed to Iran-aligned groups. The crossings reopened several days later.

Iran has reacted more openly to Iraq’s latest move than to Pakistan’s restrictions.

Deputy Interior Minister Ahmad Zeynivand said Thursday Tehran had sent Baghdad an official note seeking clarification, while claiming trade in essential goods through maritime routes and northern borders continued without disruption.

Turkey: long delays

Turkey is Iran’s third-largest trading partner, with formal and informal bilateral trade estimated at between $23 billion and $30 billion.

The Bazargan crossing in West Azerbaijan province is Iran’s most important land gateway for trade with Turkey and access to European markets.

Iranian media have reported delays of as long as 20 days at Bazargan in recent months. Although Turkey has capacity to receive 1,000 Iranian trucks daily, it has reportedly allowed only 200 to 300 through, while around 600 Turkish trucks enter Iran each day.

The bottleneck threatens a crucial alternative to Iran’s restricted maritime routes even without a formal closure of the Turkish border.

Alternatives remain limited

Iran shares land borders with seven countries, but the remaining routes offer only limited alternatives to its major trade corridors.

Crossings with Turkmenistan, Azerbaijan and Armenia remain open, providing routes toward Central Asia, Russia and the Caucasus. Afghanistan also remains open, but inadequate infrastructure and chronic congestion limit its usefulness as an alternative transit corridor.

Iran had increasingly looked to road and rail links through Central Asia after restrictions on maritime and air transport. Further border closures would therefore leave Tehran with progressively fewer ways of moving goods.

The disruptions have prompted some hard-line government supporters to call for retaliation against neighboring countries, including restrictions on Iranian electricity exports and internet transit to Iraq.

But several land routes remain open, and there is no declared land blockade. Limited capacity and existing bottlenecks mean those routes cannot readily replace maritime trade, leaving further closures capable of intensifying pressure on an economy already struggling with the effects of the US blockade.