PRINCE of Persia, a government-sponsored Iranian threat group also known as Infy, resurfaced its command-and-control (C&C) infrastructure in the United States for the first time since 2016, according to Semperis. After a three-month lull in operations, the group restarted in late May 2026 with a new Tornado-based C&C server and resumed data theft, having siphoned more than 1,800 files from a single victim within seven days.
The activity follows a period of relative silence that overlapped with the February 2026 Iran–US–Israel war, and is part of the group’s nearly two-decade campaign against dissidents, alongside government and private entities in the US, Europe and the Middle East.
By August, researchers identified a second Tornado 2 server, likely built on 7 July, located in the US—the first time Prince of Persia hosted a C&C server on US soil since 2016. The actors reportedly switched providers and moved from VPSs to Namecheap shared hosting, which sits among thousands of legitimate domains and other threat actor sites.
Security researchers noted that the attackers attempted to hide C2 activity behind Cloudflare, then deployed a second-stage Tornado server behind another Cloudflare proxy, suggesting an attempt to evade discovery after the US server was exposed. Semperis has published IoCs tied to the group’s infrastructure and urges organisations to integrate them into security tooling and monitor for suspicious Telegram-based data exfiltration traffic.