The Iranian-backed cyber threat group known as Prince of Persia, also referred to as Infy, has resumed its operations using a command-and-control (C&C) server located in the United States. This marks the first time since 2016 that the group has hosted infrastructure within the country, as reported by cybersecurity firm Semperis.
Background on Prince of Persia’s Activities
Active for nearly two decades, Prince of Persia primarily targets Iranian dissidents, as well as governmental and private organizations in the United States, Europe, and the Middle East. Tomer Bar, a security researcher at Semperis, has been tracking this group and noted its operations were paused for an unusually long period earlier this year.
Following a report by SafeBreach in February 2026, Prince of Persia went silent for three months, the longest downtime in its history. This pause coincided with heightened geopolitical tensions, specifically the conflict involving Iran, the United States, and Israel, which erupted on February 28.
Resumption of Cyber Operations
On May 27, the group reactivated its operations, with a new C&C server facilitating data theft activities. Within a week, their malware, known as Tonnerre, had exfiltrated over 1,800 files from a single target. Although the number of victims remains low, this may indicate either a targeted approach or difficulties in compromising more systems.
In August, Bar discovered a new server likely established on July 7. This server is believed to support Tornado, the group’s latest malware family, which can steal files through a Telegram bot. The presence of this server in the US marks a shift in Prince of Persia’s strategy, as they typically avoid hosting within the country.
New Tactics and Security Recommendations
According to Bar, the group has switched its hosting provider, opting for shared hosting with Namecheap instead of virtual private servers. This approach, while common among nation-state actors, is unusual for Prince of Persia. On August 24, they began setting up another server, this time obscured by Cloudflare, suggesting awareness of their exposure.
Semperis has shared indicators of compromise (IoCs) linked to the group’s infrastructure, advising organizations to integrate these into their security measures. Monitoring for suspicious Telegram traffic is also recommended to detect potential threats early.
This development highlights the evolving tactics of cyber threat groups and the importance of robust cybersecurity defenses. As Prince of Persia continues to adapt, organizations must remain vigilant to protect their data and networks.
