Prince of Persia / Infy

Semperis (Tomer Bar, AVP of Security Research, Oct 22, A/2) documents the current state of Prince of Persia (aka Infy), an Iranian nation-state-sponsored espionage group active for nearly two decades against Iranian dissidents and public and private organizations in the US, Europe and the Middle East. When the US–Iran conflict began on February 28, 2026, the group went dark for three months — the longest downtime in its history — then rebuilt: operations restarted May 27, 2026 with a new C2 bank. This research explicitly covers the group's actions since SafeBreach's February 4, 2026 report (same researcher, then at SafeBreach): the C2 server 45.80.148.249 was shut down within a week of that publication and victim GUIDs were purged from the long-standing updatelist.txt management file. The newly located Tornado second-stage C2 — missing from the public picture since September 2025 — runs on US Namecheap shared hosting managed with cPanel, which the primary describes as the group's first US-hosted server in a decade; a further server was rebuilt behind Cloudflare on August 24, 2026, which Semperis suspects followed the actor realizing its newest server had been discovered. The current families use DGA-generated domains alongside non-DGA domains (both appear in the published IOC sets), and incoming C2 requests are authenticated with RSA signature validation, which Semperis describes as locking out security researchers and automated scanners — Tonnerre's anti-takeover signatures are described as preventing sinkholing, the matured counter to Unit 42's 2016 sinkhole of the group's Infy-era C2 (documented in Unit 42's own follow-up research). Exfiltration runs through a Telegram bot: the Tornado second-stage C2 hosts a tga.adr file, obtainable by specific victims, containing the Telegram bot API key used to exfiltrate victim files to a Telegram group chat controlled by the actor — the API key and chat ID live in the C2 backend configuration rather than the malware (the file was unavailable at publication, and Semperis suspects the actor changed its filename). Tornado, the newest family (version 51), builds on the Foudre/Tonnerre codebase, can be delivered through one-day software vulnerabilities (WinRAR exploits cited), and can decode fields hidden in blockchain transactions to change C2 routing without updating malware on victims. Observed campaign activity: in the first week after the May 27 restart, Tonnerre exfiltrated more than 1,800 files from one victim; an August 2026 victim was still active; Semperis monitored the exfiltration for six months and describes a low victim count that could indicate either targeted attacks or difficulty infecting new victims.

1. 1

   First-stage C2 beacons resolve DGA-rotated family domains

   C2: first-stage beacons to DGA-rotated family domains

   • T1568.002Dynamic Resolution: Domain Generation Algorithms

   Logs

   • Microsoft DNS server query logs · resolver queries for published C2 domains; family-domain rotation over time
   • Enterprise web proxy · C2 IP connections; inspected-URL Telegram Bot API requests; tga.adr fetch

   Detectors

   No known detector

• A/2Semperis: Prince of Persia — a threat group hiding in plain sight (primary)
• A/3Semperis press release: Iranian threat group operating C2 in the United States (primary announcement)
• B/3SecurityWeek: Iran's Prince of Persia APT hosts C&C in US for first time since 2016 (retelling)

Grades are source reliability (A–F) and information credibility (1–6).