Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

Prince of Persia, an Iranian government-sponsored advanced persistent threat (APT) group active for nearly 20 years, paused operations for three months in early 2026 during the Iran-US-Israel conflict. After this lull, the group resumed data theft operations using its Tornado malware family. Notably, it hosted a Tornado second-stage command-and-control server on US shared hosting infrastructure in 2026, the first US-based C&C server since 2016. This server was hosted on Namecheap shared hosting, a departure from prior use of virtual private servers. The group also deployed additional infrastructure behind Cloudflare. Tornado malware capabilities include file theft via Telegram bots. Semperis has tracked the group’s infrastructure and shared IoCs for defensive use.

Prince of Persia’s operations involve targeted espionage and data theft, primarily against Iranian dissidents and entities in the US, Europe, and the Middle East. The deployment of a US-hosted C&C server may complicate attribution and takedown efforts. The group’s malware has successfully exfiltrated thousands of files from victims. The impact is primarily espionage and data compromise, with no evidence of broader disruption or destructive activity reported.

No official patch or fix applies as this is an APT threat actor’s operational activity rather than a software vulnerability. Semperis has shared indicators of compromise related to Prince of Persia’s infrastructure. Organizations should integrate these IoCs into detection tools and monitor for suspicious Telegram traffic associated with the Tornado malware. Awareness of the group’s tactics and infrastructure changes can aid in defense. No vendor advisory indicates that the threat is mitigated or no action is required.