AN Iranian nation-state threat group known as Prince of Persia has been found hosting its command-and-control (C2) infrastructure in the United States to support malware delivery and cyber-espionage campaigns. The activity was uncovered by Semperis, which published its findings on 22 October 2026. Prince of Persia has operated for about two decades and targets public and private sector organisations across the US, Europe and the Middle East, as well as dissidents and others opposed to the Iranian regime.
The campaign employs multiple forms of malware, including Foudre (a first-stage loader) and Tonnerre (a second-stage malware that provides extensive surveillance capabilities), with a newer variant named Tornado building on earlier code. Tornado can use both HTTPS and the Telegram API as a covert C2 channel, enabling it to blend with legitimate traffic and evade some detections.
Researchers noted that the group has long used anti-detection techniques and hosted activity on European providers; the Tornado findings, however, pointed to hosting on a US-based company—the first such instance for Prince of Persia in at least 12 years. Semperis’ guidance to reduce risk includes keeping security controls up to date, monitoring for unusual Telegram traffic, and ensuring operating systems are fully patched and updated.