Iran's Prince of Persia APT hosts C&C in the US for the first time since 2016 after a three-month lull
Prince of Persia (also tracked as Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a command-and-control server in the United States this year, according to Semperis. It is the first time the group has done so since 2016. The group went quiet for three months after SafeBreach's February 2026 report, the longest confirmed downtime in its history, overlapping with the war between Iran and the US and Israel that began on February 28. Operations resumed on May 27 with a new C&C server. Its targets are mostly Iranian dissidents, plus government and private entities in the US, Europe and the Middle East.
Detalhes técnicos
- Within a week of SafeBreach's February 2026 report, the group took a C&C server offline and later relocated the rest of its servers (per researcher Tomer Bar, formerly at SafeBreach and now at Semperis).
- After the restart on May 27, the Tonnerre malware family siphoned more than 1,800 files from a single victim within seven days. The victim count remains small, which may indicate targeted attacks or difficulty compromising new systems.
- In August, Bar identified a server, likely built on July 7, that supports the second stage of Tornado, the group's latest malware family. Tornado can steal files through a Telegram bot.
- That server was in the US and sat on Namecheap shared hosting, a departure from the group's earlier use of VPSs.
- On August 24, the group began setting up another Tornado second-stage server behind Cloudflare. Semperis suspects the group realized its US-hosted server had been exposed.
- Semperis has shared IoCs tied to the group's infrastructure. They are not listed in this article.
Remediação
- Add the IoCs shared by Semperis to security tooling.
- Monitor for suspicious Telegram traffic.
Linha do tempo
-
Iran's Prince of Persia APT hosts C&C in the US for the first time since 2016 after a three-month lull
ler a análise desta fonte ocultar
Prince of Persia (also tracked as Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a command-and-control server in the United States this year, according to Semperis. It is the first time the group has done so since 2016. The group went quiet for three months after SafeBreach's February 2026 report, the longest confirmed downtime in its history, overlapping with the war between Iran and the US and Israel that began on February 28. Operations resumed on May 27 with a new C&C server. Its targets are mostly Iranian dissidents, plus government and private entities in the US, Europe and the Middle East.
Technical Details
- Within a week of SafeBreach's February 2026 report, the group took a C&C server offline and later relocated the rest of its servers (per researcher Tomer Bar, formerly at SafeBreach and now at Semperis).
- After the restart on May 27, the Tonnerre malware family siphoned more than 1,800 files from a single victim within seven days. The victim count remains small, which may indicate targeted attacks or difficulty compromising new systems.
- In August, Bar identified a server, likely built on July 7, that supports the second stage of Tornado, the group's latest malware family. Tornado can steal files through a Telegram bot.
- That server was in the US and sat on Namecheap shared hosting, a departure from the group's earlier use of VPSs.
- On August 24, the group began setting up another Tornado second-stage server behind Cloudflare. Semperis suspects the group realized its US-hosted server had been exposed.
- Semperis has shared IoCs tied to the group's infrastructure. They are not listed in this article.
Remediation
- Add the IoCs shared by Semperis to security tooling.
- Monitor for suspicious Telegram traffic.