Iran's Prince of Persia APT hosts command servers in the US for first time since 2016

Prince of Persia, an Iranian government-sponsored threat group that has been active for close to 20 years, is hosting command-and-control (C&C) infrastructure in the United States for the first time since 2016, according to new research from Semperis reported by SecurityWeek. The group, also tracked as Infy, has historically targeted Iranian dissidents as well as government and private entities in the US, Europe and the Middle East. The findings show the actor resumed data theft after an extended pause and adapted its infrastructure to blend in with legitimate hosting.

What happened

According to SecurityWeek, Semperis researchers led by Tomer Bar, who previously tracked the group at SafeBreach, monitored the actor's infrastructure throughout 2026. After SafeBreach published a report on the group in February, the hackers took a C&C server offline within a week and later relocated other servers. The group then went quiet for about three months, a halt that overlapped with the outbreak of war between Iran and the US and Israel on February 28. Semperis described it as the longest downtime it has confirmed.

Operations resumed on May 27, 2026, with a new C&C server, and data theft restarted. Semperis said the group's Tonnerre malware siphoned more than 1,800 files from a single victim within seven days of the restart.

Technical details

The group's latest malware family, Tornado, can steal files through a Telegram bot, according to the report. In August, researchers identified a new US-located server supporting Tornado's second stage, likely built on July 7. On August 24, a second such server began being set up behind Cloudflare, which Semperis suspects was a reaction to the group realizing its US server had been exposed.

The attackers also moved from virtual private servers to Namecheap shared hosting, which serves thousands of domains. "This is the last place we expected to find Prince of Persia hiding," Bar said, adding that it is not unusual for state-sponsored groups to hide C2 servers inside the United States.

Who is affected

Semperis said the victim count remains small, which may indicate targeted attacks or difficulty compromising new systems. The researchers also noted that earlier quiet periods attributed to the group reflected gaps in visibility rather than confirmed inactivity.

What to do

SecurityWeek said organizations should add the indicators of compromise published in Semperis's blog to their security tools and monitor for suspicious Telegram traffic, particularly from hosts that have no business reason to communicate with the messaging service. Traffic to shared hosting and CDN-fronted domains should not be considered trustworthy by default.