Prince of Persia resumes espionage with first US C2 since 2016

Semperis says Iran’s Prince of Persia resumed espionage on May 27 and hosted Tornado command-and-control in the United States.

Semperis says Iranian state-sponsored Prince of Persia, also tracked as Infy, resumed espionage on May 27 after a three-month pause following a February 2026 SafeBreach report and overlapping the Iran war. Its toolkit includes the Foudre loader, second-stage Tonnerre and newer Tornado, which can use HTTPS and a Telegram bot to steal files. Tonnerre took more than 1,800 files from one victim within a week; a US Tornado server, likely built July 7, was the group’s first US command-and-control since 2016, and anti-detection features initially hid it. Researchers later found Namecheap shared hosting and, from August 24, a server behind Cloudflare. Semperis published indicators, urged monitoring Telegram traffic and says the victim count remains small; targets include US, European and Middle Eastern organizations plus regime opponents.