Prince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations
The APT actor, also tracked as Infy, has been operating for close to 20 years. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe, and the Middle East.
Tomer Bar, AVP of security research at Semperis, tracked the group in his previous role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report, the hackers took a C&C server offline and later relocated the rest of their servers.
Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel, which broke out on February 28.
Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity.
Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim.
Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems.
In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot.
The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says.
“It is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes.
For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, home to thousands of domains, including legitimate sites and some operated by other threat actors.
“This is the last place we expected to find Prince of Persia hiding,” Bar said.
On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed.
Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic.
Related Content
Cybercrime
In Rare Move, Alleged Iranian State Hacker Extradited to US
Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad.
Malware & Threats
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
The state-sponsored group has launched larger-scale phishing campaigns to deploy the CosmicPulse backdoor.
Malware & Threats
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.
ICS/OT
Iran-Linked Hackers Shut Down UK Power Plant for Four Days
The attack caused real-world operational disruption and raised concerns about the resilience of Britain’s distributed energy infrastructure and the potential for repeatable attacks.
Cyberwarfare
US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them
The 17 members of the Mabna Institute targeted hundreds of universities and organizations in the US and abroad.
Vulnerabilities
Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.
ICS/OT
Water Sector Cyberattacks Reportedly Hit at Least 12 States
Georgia has been confirmed as one of the attacked states after Clayton County reported a pump station disruption.
Mobile & Wireless
Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking
Midnight Blizzard has been stealing Microsoft account credentials
