Iranian Prince of Persia APT Resumes Operations, Hosts C2 Server in US
Summary
Semperis reports that the Iranian government-sponsored Prince of Persia group resumed operations in May 2026 and hosted a C2 server in the US for the first time since 2016. Its Tonnerre malware reportedly stole over 1,800 files from one victim.
Key points
- Semperis says Prince of Persia, also known as Infy, resumed operations on May 27 after a three-month pause.
- Within seven days of resuming, the group's Tonnerre malware reportedly siphoned over 1,800 files from one victim.
- In August, researchers identified a US-hosted server supporting the second stage of Tornado, the group's latest malware family.
- Tornado can steal files through a Telegram bot, according to the article.
- Semperis says this was the group's first US-hosted C2 server since 2016; the server used Namecheap shared hosting rather than VPSs.
- On August 24, the group began setting up another Tornado second-stage server behind Cloudflare; Semperis suspects it had realized the US server was exposed.
- Semperis shared indicators of compromise and advised organizations to add them to security tools and monitor for suspicious Telegram traffic.
Article Details
- Event Type
- Threat group operational resumption and command-and-control infrastructure changes
- Impact
- Prince of Persia resumed operations on May 27 and data theft. Its malware Tonnerre reportedly stole over 1,800 files from one victim within seven days. The group also deployed a US-hosted command-and-control server, its first such hosting in the country since 2016, and later set up another Tornado second-stage server behind Cloudflare.
People
Threat Actors
Malware
Tonnerrerestarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim.TornadoIn August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado.
Vendors
CloudflareOn August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare.NamecheapThey also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, home to thousands of domains, including legitimate sites and some operated by other threat actors.
Products
Countries
IranThe pause overlapped with the war between Iran and the US and Israel, which broke out on February 28.United StatesPrince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations, according to Semperis.