Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

The APT actor, also tracked as Infy, has been operating for close to 20 years. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe, and the Middle East. Tomer Bar, AVP of security research at Semperis, tracked the group in his role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report , the hackers took a C&C server offline and later relocated the rest of their servers. Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel , which broke out on February 28. Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity. Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim. Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems. In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Tomer Bar, AVP of security research at Semperis, tracked the group in his role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report , the hackers took a C&C server offline and later relocated the rest of their servers. Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel , which broke out on February 28. Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity. Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim. Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems. In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel , which broke out on February 28. Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity. Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim. Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems. In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity. Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim. Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems. In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim. Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems. In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems. In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot. The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says. “It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

“It is not unusual for nation-state– threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes. For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, to thousands of domains, including legitimate sites and some operated by other threat actors. “This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

“This is the last place we expected to find Prince of Persia hiding,” Bar said. On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed. Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic. Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Related : In Rare Move, Alleged Iranian State Hacker Extradited to US Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Related : US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from Eduard Kovacs

Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring

970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Hacker Conversations: Corey Thuen and the Evil Bit

Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Splunk, SolarWinds Release Fresh Security Updates

Cisco Patches 34 Vulnerabilities Across Multiple Products

PHP2Shell Exploitation Started Days Before Patches

Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Flipboard Whatsapp Whatsapp Email