The group used US-hosted servers and malware capable of stealing files and routing commands through Telegram, researchers say
An Iranian-linked cyberespionage group has rebuilt its command-and-control infrastructure after an unusually long period of inactivity, adopting new hosting arrangements and continuing to use malware designed to steal sensitive files and conduct surveillance, according to research published by cybersecurity company Semperis.
The group, known as Prince of Persia or Infy, resumed activity in May 2026 after approximately three months without publicly identified operations, Semperis said in a blog post published October 22. Researchers traced renewed data exfiltration to a command-and-control (C2) server and found that the attackers had moved beyond their previously known infrastructure.
During the first week of activity on the newly identified server, the group’s Tonnerre malware exfiltrated more than 1,800 files from a victim, according to Semperis. The company withheld identifying details about the victim, citing privacy concerns.
The findings highlight how a prolonged absence of visible activity can complicate efforts to track an established espionage operation. They also show how attackers can change their hosting arrangements and communications infrastructure while retaining elements of an existing malware toolkit.
New infrastructure after a three-month pause
Prince of Persia has operated for nearly two decades, primarily targeting Iranian dissidents and public- and private-sector organizations in the US, Europe and the Middle East, according to Semperis. Its activities have previously been documented by Palo Alto Networks’ Unit 42 and SafeBreach.
Semperis said the group stopped showing publicly identifiable activity in March 2026. Its downtime ended on May 27, when researchers identified a new C2 server at IP address 185.244.129.70. The server was associated with the domain aa58862c.ddns.net, and researchers observed data exfiltration beginning shortly after its deployment.
The researchers said the group abandoned previously known C2 servers, changed hosting providers and shifted from virtual private server infrastructure to shared public hosting. This placed some of its infrastructure alongside legitimate websites and sites associated with unrelated threat actors.
Semperis also identified a change in the location of the group’s infrastructure. The researchers said the discovery of a Tornado second-stage C2 server hosted in the US marked the first time in a decade that they had identified the Iranian-linked actor hosting this part of its operation on US soil.
The change does not, by itself, establish that the group was targeting US organizations. Rather, it demonstrates how the geographical location and hosting arrangements of malicious infrastructure can change, complicating attribution and detection.
Three malware families support espionage
The operation uses three principal malware families: Foudre, Tonnerre and Tornado.
Foudre acts as an initial-stage implant, enabling reconnaissance, persistence and victim profiling. It can collect information about infected systems, steal browser credentials and log keystrokes. The malware helps the operators determine which compromised machines warrant further attention.
Tonnerre is deployed against selected victims and provides more extensive surveillance and data-theft capabilities. Semperis said the malware can extract sensitive documents, capture screenshots and record audio. Its operators can therefore gather information beyond conventional system reconnaissance.
Tornado, a more recently identified addition to the group’s toolkit, uses a combination of HTTPS and the Telegram API for command-and-control communications. The approach allows malicious traffic to blend with legitimate web and messaging activity, potentially making it harder for security teams to distinguish from normal network traffic.
The malware also uses domain-generation algorithms (DGAs), which generate changing domain names for locating C2 servers. Such mechanisms can complicate detection based solely on static domain blocklists.
Semperis said Tornado can also use blockchain transaction data to obtain information that changes C2 routing. This can allow operators to redirect communications without distributing an updated malware binary to every infected system.
The researchers further documented the use of RSA signature validation to authenticate incoming C2 requests, a technique that makes it harder for outside researchers and automated scanners to map the group’s infrastructure.
Hosting changes complicate detection
The researchers identified additional changes in how the group deployed its infrastructure. In July 2026, a Tornado second-stage C2 server was identified on infrastructure associated with Namecheap. Semperis said the server used shared hosting that supported thousands of independent domains, including sites associated with unrelated malicious activity.
On August 24, the group began building another C2 server behind Cloudflare infrastructure, according to the research. Semperis subsequently identified a server supporting Tornado, Tonnerre and Foudre at IP address 185.244.129.123, which was active from September 1.
These findings illustrate the limitations of relying exclusively on known malicious IP addresses or dedicated servers to identify an espionage campaign. Infrastructure shared with legitimate services can make it harder to distinguish malicious activity from ordinary web traffic, while changes in domains and hosting providers can render older indicators of compromise less useful.
The research also suggests that the group’s apparent inactivity should not be interpreted as evidence that its capabilities have disappeared. Although the operators changed infrastructure, Semperis found continued use of the established malware families.
What security teams should watch
Semperis recommends that organizations update their security controls with the indicators of compromise published in the research, monitor for unusual Telegram traffic and ensure that operating systems are fully patched.
For defenders, the findings also underscore the value of monitoring behavior rather than depending exclusively on static indicators. Unexpected communications with Telegram, unusual outbound transfers of sensitive files and suspicious connections to newly observed domains can warrant investigation, particularly when they occur alongside signs of endpoint compromise.
The research does not identify the victim whose files were stolen or establish the full extent of the campaign’s reach. Nevertheless, the recovery of active infrastructure and evidence of data exfiltration indicate that Prince of Persia remains an operational threat, despite its extended period of reduced visibility.
