Prince of Persia APT hosts C&C in US for first time since 2016
Original title: Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month pause, Tonnerre stole more than 1,800 files from one victim within a week of the May 27 restart.
Semperis said Iranian state-sponsored Prince of Persia, also tracked as Infy, resumed on May 27 after a three-month pause and hosted a command-and-control server in the United States, its first there since 2016. Tonnerre stole more than 1,800 files from one victim within a week. In August researchers found a Tornado second-stage server on Namecheap shared hosting, then another behind Cloudflare from August 24. Semperis shared infrastructure indicators and advised watching Telegram traffic.
Unconfirmed: The July 7 server date is described as likely, and Semperis only suspects the group noticed the US server was exposed.
- The lull followed a February 2026 SafeBreach report and overlapped the Iran war.
- Targets are mostly Iranian dissidents plus US, European and Middle East entities.
- Tornado can steal files through a Telegram bot.
- The US server was likely built on July 7.
- Semperis says the victim count is still small.
Impact: Files stolen from victims through Tonnerre and Tornado
- 1.Add Semperis Prince of Persia infrastructure indicators to security tools.
- 2.Watch for suspicious Telegram traffic associated with Tornado.
- ATT&CK
- T1102.002 Bidirectional CommunicationT1041 Exfiltration Over C2 ChannelT1005 Data from Local System
- Threat actors
- Prince of PersiaInfy
- Organizations
- SemperisNamecheapCloudflare
- Countries
- IranUnited States
From the original article
2 min read at securityweek.com
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.