Iran's Prince of Persia APT ran a C&C server from US shared hosting, researchers say

Past-week coverage · Original source published 2026-10-23.

Prince of Persia, a threat group described as sponsored by the Iranian government, ran one of its command-and-control servers from the United States this year, according to research from Semperis reported by SecurityWeek.

The group, also tracked as Infy, has operated for close to 20 years, mostly against Iranian dissidents and against government and private entities in the US, Europe and the Middle East.

Tomer Bar, now AVP of security research at Semperis, tracked the group in a previous role at SafeBreach. He says that within a week of SafeBreach's February 2026 report, the hackers took a C&C server offline and later moved the rest of their servers. Prince of Persia then went quiet for three months, which Semperis says is the longest confirmed downtime in its history. The pause overlapped with the war between Iran and the US and Israel.

Operations restarted on May 27 with a new C&C server, and data theft resumed. Within seven days, one malware family, Tonnerre, had taken over 1,800 files from a single victim. Bar says the victim count is still small, possibly a sign of targeted attacks or of difficulty compromising new systems.

In August, Bar identified a new server, likely built on July 7, supporting the second stage of Tornado, the group's latest malware family, whose capabilities include stealing files through a Telegram bot. The server sat in the US, the first time since 2016 the group has hosted C&C inside the country, Bar says. The attackers switched providers and moved from virtual private servers to Namecheap shared hosting.

"It is not unusual for nation-state-sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor," Bar said.

On August 24, the group began setting up another Tornado second-stage server behind Cloudflare. Semperis suspects the hackers realized their US-hosted server was exposed.

Semperis has shared indicators of compromise tied to the infrastructure. It advises organizations to add them to security tools and watch for suspicious Telegram traffic.