Iranian APT 'Prince of Persia' Hosts C&C Server in US for First Time Since 2016

Iranian APT Resurfaces with US-Based Infrastructure

The Iranian government-backed threat group known as 'Prince of Persia' or Infy has resumed operations, deploying a command-and-control (C&C) server within the United States. This marks a significant shift in their infrastructure strategy, as it is the first time since 2016 that the group has hosted a C&C server inside the US.

The group, active for nearly two decades, primarily targets Iranian dissidents, as well as government and private entities in the US, Europe, and the Middle East.

Longest Operational Pause and Resumption

Prior to the discovery of the new US-based server, Prince of Persia experienced a three-month operational lull, which is the longest period of inactivity confirmed by researchers. This pause followed a report in February 2026 that led the group to take a C&C server offline and relocate others. The downtime coincided with the conflict between Iran, the US, and Israel that began on February 28.

Operations restarted on May 27 with the deployment of a new C&C server, and data theft quickly resumed. Within a week, one of their malware families, Tonnerre, exfiltrated over 1,800 files from a single victim.

Shift in Hosting Tactics

In August, a new server supporting the second stage of Tornado, the group's latest malware family capable of stealing files via a Telegram bot, was identified in the US. This server was likely built on July 7.

For this new infrastructure, the attackers changed providers and moved away from virtual private servers (VPSs) to Namecheap shared hosting. This is considered an unusual move for this specific threat actor, as shared hosting environments are home to numerous domains, including legitimate sites and those used by other threat actors.

Implications of the Change

While nation-state-sponsored groups often hide C&C servers within the US using cloud infrastructure, this specific shift to shared hosting is unexpected for Prince of Persia. The current victim count remains small, which researchers suggest could indicate either highly targeted attacks or difficulties in compromising new systems.