Prince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations, according to Semperis.
The APT actor, also tracked as Infy, has been operating for close to 20 years. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe, and the Middle East.
Tomer Bar, AVP of security research at Semperis, tracked the group in his previous role at SafeBreach. He says that within a week of SafeBreach’s February 2026 report, the hackers took a C&C server offline and later relocated the rest of their servers.
Prince of Persia then halted operations for three months, a longer silence than any other in its nearly two-decade history. The pause overlapped with the war between Iran and the US and Israel, which broke out on February 28.
Semperis told SecurityWeek that this is the longest downtime it has confirmed, as its researchers were monitoring the group’s infrastructure the entire time. Earlier quiet periods reflected gaps in researchers’ visibility into the group’s operations rather than confirmed inactivity.
Prince of Persia’s operations restarted on May 27 with the deployment of a new C&C server, and data theft resumed. Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim.
Bar says the victim count is still small, possibly a sign that the group is either running targeted attacks or struggling to compromise new systems.
In August, Bar identified a new server, likely built on July 7, that supports the second stage of Tornado. Tornado is the group’s latest malware family, and its capabilities include stealing files through a Telegram bot.
The server was located in the US, the first time since 2016 that the group has hosted a C&C server inside the country, Bar says.
“It is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor,” Bar notes.
For this server, the attackers switched providers. They also abandoned virtual private servers (VPSs) in favor of Namecheap shared hosting, home to thousands of domains, including legitimate sites and some operated by other threat actors.
“This is the last place we expected to find Prince of Persia hiding,” Bar said.
On August 24, the group began setting up another Tornado second-stage server hidden behind Cloudflare. Semperis suspects the hackers had realized that their US-hosted server was exposed.
Semperis has shared IoCs tied to Prince of Persia’s infrastructure. It advises organizations to add them to their security tools and watch for suspicious Telegram traffic.
Related: In Rare Move, Alleged Iranian State Hacker Extradited to US
Related: US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
