Prince of Persia APT hosts command-and-control server in US

The Iranian state-sponsored threat group Prince of Persia, also known as Infy, has hosted a command-and-control (C&C) server within the United States for the first time since 2016. According to research from Semperis, the group resumed operations in late May 2026 following a three-month period of inactivity that coincided with the outbreak of conflict between Iran, the US, and Israel in February.

The group, which has been active for nearly two decades, primarily targets Iranian dissidents as well as government and private entities in the US, Europe, and the Middle East. Researchers noted that the group has updated its infrastructure to include hosting behind Cloudflare and utilizing Telegram API channels, domain generation algorithms, and blockchain-based data exfiltration techniques to hide its activities among legitimate web traffic.

Recent activity includes the deployment of the ‘Tornado’ malware family, which is capable of siphoning files via a Telegram bot. While the current victim count appears relatively small, suggesting highly targeted attacks, the relocation of infrastructure to US-based hosting marks a significant shift in the group’s operational tactics.