Iranian APT Prince of Persia (Infy) hosts C2 on US servers for the first time in about a decade, deploying Foudre, Tonnerre and Tornado
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:01; os links antigos trazem para cá.
Semperis reported on October 22, 2026 that the Iranian state-linked group Prince of Persia (also tracked as Infy), active for roughly two decades, hosted command-and-control (C2) infrastructure with a US hosting company (infosecurity-magazine.com, securityweek.com). The group targets public and private organisations in the US, Europe and the Middle East, plus Iranian dissidents and regime opponents. Its malware steals documents, takes covert screenshots and captures audio (infosecurity-magazine.com). After a roughly three-month lull, the longest confirmed downtime in its history, it resumed operations on May 27 with a new C2 server (securityweek.com). The lull followed SafeBreach's February 2026 report and overlapped with the US/Israel-Iran war that began on February 28 (securityweek.com). The victim count remains small, which may indicate targeted attacks or difficulty compromising new systems (securityweek.com).
Detalhes técnicos
- Foudre is a first-stage loader. Tonnerre is a second-stage implant with full surveillance capabilities (infosecurity-magazine.com).
- Tornado is the group's latest malware family and builds on earlier tooling. It can use HTTPS and the Telegram API (a Telegram bot) as a covert C2 and exfiltration channel that blends in with legitimate traffic (infosecurity-magazine.com, securityweek.com).
- Within a week of SafeBreach's February report, the group took one C2 server offline and later relocated the rest of its servers, according to researcher Tomer Bar, formerly at SafeBreach and now at Semperis (securityweek.com).
- After the May 27 restart, Tonnerre siphoned more than 1,800 files from a single victim within seven days (securityweek.com).
- In August, Bar identified a server, likely built on July 7, that supports the second stage of Tornado. It was in the US on Namecheap shared hosting, a departure from the group's earlier use of European hosting and VPS providers (securityweek.com, infosecurity-magazine.com).
- Anti-detection features initially hindered researchers, but information inside Tornado revealed where the campaign was hosted (infosecurity-magazine.com).
- On August 24, the group began setting up another Tornado second-stage server behind Cloudflare. Semperis suspects the group realized its US-hosted server had been exposed (securityweek.com).
- Semperis has shared IoCs tied to the group's infrastructure, but neither article lists them. No CVEs or initial access vector are given.
Remediação
- Add the IoCs shared by Semperis to security tooling (securityweek.com).
- Monitor for unusual or suspicious Telegram traffic (infosecurity-magazine.com, securityweek.com).
- Keep security controls and operating systems fully updated (infosecurity-magazine.com).
Relatos divergentes
- Time since last US hosting: infosecurity-magazine.com says this is the first time in at least 12 years that an Iranian threat group has been seen hosting on US servers. securityweek.com says it is the first time Prince of Persia itself has done so since 2016. The two framings differ (any Iranian group versus this group; 12+ years versus since 2016). securityweek.com is more specific and more recent, but neither is confirmed by a primary Semperis publication in the input.
- Dormancy: infosecurity-magazine.com says the group appeared to go dark in February 2026, coinciding with US and Israeli strikes on Iran. securityweek.com ties the lull to the aftermath of SafeBreach's February report, lasting three months until May 27, and notes the war began on February 28. The sources differ on the cause, so it is unclear whether the war or the exposure drove the pause.
Linha do tempo
-
Iran's Prince of Persia APT hosts C&C in the US for the first time since 2016 after a three-month lull
ler a análise desta fonte ocultar
Prince of Persia (also tracked as Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a command-and-control server in the United States this year, according to Semperis. It is the first time the group has done so since 2016. The group went quiet for three months after SafeBreach's February 2026 report, the longest confirmed downtime in its history, overlapping with the war between Iran and the US and Israel that began on February 28. Operations resumed on May 27 with a new C&C server. Its targets are mostly Iranian dissidents, plus government and private entities in the US, Europe and the Middle East.
Technical Details
- Within a week of SafeBreach's February 2026 report, the group took a C&C server offline and later relocated the rest of its servers (per researcher Tomer Bar, formerly at SafeBreach and now at Semperis).
- After the restart on May 27, the Tonnerre malware family siphoned more than 1,800 files from a single victim within seven days. The victim count remains small, which may indicate targeted attacks or difficulty compromising new systems.
- In August, Bar identified a server, likely built on July 7, that supports the second stage of Tornado, the group's latest malware family. Tornado can steal files through a Telegram bot.
- That server was in the US and sat on Namecheap shared hosting, a departure from the group's earlier use of VPSs.
- On August 24, the group began setting up another Tornado second-stage server behind Cloudflare. Semperis suspects the group realized its US-hosted server had been exposed.
- Semperis has shared IoCs tied to the group's infrastructure. They are not listed in this article.
Remediation
- Add the IoCs shared by Semperis to security tooling.
- Monitor for suspicious Telegram traffic.
-
Iranian APT Prince of Persia hosts C2 infrastructure on US servers in Foudre, Tonnerre and Tornado espionage campaign
ler a análise desta fonte ocultar
Researchers at Semperis reported on October 22 that the Iranian state-linked group Prince of Persia, active for about two decades, is hosting command-and-control (C2) infrastructure with a US hosting company. According to Semperis, this is the first time in at least 12 years that an Iranian threat group has been identified hosting its activity on US servers. The group targets public and private sector organisations in the US, Europe and the Middle East, as well as dissidents and opponents of the Iranian regime. Its malware allows theft of documents, covert screenshots and audio capture. The group appeared to go dark in February 2026, coinciding with US and Israeli strikes against Iran, according to Tomer Bar of Semperis.
Technical Details
- Foudre is a first-stage loader; Tonnerre is a second-stage implant that gives full surveillance capabilities.
- Tornado is a more recently identified malware that builds on the codebase of earlier tooling. It can use both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate traffic to evade firewalls and detection.
- The group previously hid activity on European hosting services and VPS providers. Anti-detection features initially hindered researchers, but information inside Tornado revealed where the campaign was hosted.
- The article gives no IOCs, CVEs or initial access vector.
Remediation
Semperis recommends:
- Keeping security controls up to date.
- Monitoring for unusual Telegram traffic.
- Keeping operating systems fully updated.