Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

What it is

Prince of Persia (also tracked as Infy) is an Iranian state-sponsored APT that has operated for close to 20 years. Semperis researcher Tomer Bar reports that in July 2026 the group built a US-hosted C&C server for the second stage of Tornado, its newest malware family. It is the first US-hosted C&C since 2016. The page names targets as mostly Iranian dissidents, plus government and private entities in the US, Europe, and the Middle East.

How it works

Tornado can steal files through a Telegram bot, which is why Semperis points defenders at Telegram traffic. Bar found the second-stage server in August 2026 and dates its build to about 7 July. It ran on Namecheap shared hosting rather than the VPSs the group used before. Namecheap shared hosting serves thousands of domains, including legitimate sites and some run by other threat actors. Tonnerre, another of the group's families, took over 1,800 files from a single victim within seven days of the 27 May restart.

timeline
    title Prince of Persia 2026
    February : SafeBreach report : C&C taken offline within a week
    28 Feb : Iran war with US and Israel begins
    Mar to May : Three-month halt
    27 May : New C&C, theft resumes
    7 Jul : US server likely built
    24 Aug : Cloudflare-fronted replacement begins

What to do

Semperis has shared IoCs for the group's infrastructure. It advises loading them into security tools and watching for suspicious Telegram traffic. The page does not reproduce the IoCs or give a detection query.

Caveats

• The shared hosting means IP-level blocking of that server's address range would catch unrelated sites.
• Bar says the victim count is still small. That may mean targeted attacks or trouble compromising new systems.
• Semperis only suspects the Cloudflare move was a response to the US server being exposed.
• The three-month halt is the longest silence Semperis has confirmed, since it monitored the group's infrastructure throughout. Earlier quiet periods may reflect gaps in researcher visibility. The halt overlapped with the war that began on 28 February 2026.