Active Return and Change in Tactics
Following a three-month hiatus, the longest in its two-decade history, the Iranian government-backed cyber threat group known as Prince of Persia (also known as Infy) resumed its operations in May 2026. Research by Semperis revealed that last August, the group moved one of its command-and-control (C&C) servers into the United States, marking the first time the group has resorted to this measure since 2016.
What is Changing in Practice?
This infrastructure shift by the group is a notable development; the group abandoned the use of Virtual Private Servers (VPS) in favor of shared hosting services from Namecheap. Tomer Bar, Vice President of Security Research at Semperis, explains that this behavior is unusual for the group, as shared hosting hosts thousands of legitimate domains, making the detection of threat servers much more difficult.
The group uses a modern malware family called Tornado, which includes advanced file-stealing capabilities via Telegram application bots. Research has tracked that the group has already begun using a new server to support the second phase of Tornado attacks, before later moving to use servers protected behind Cloudflare, indicating that the attackers realize the potential of their US server being exposed.
Why Does This News Matter?
The Prince of Persia group primarily targets Iranian dissidents, as well as government and private entities in the United States, Europe, and the Middle East. The significance of this report lies in the following points:
- Changing Stealth Strategy: Using shared hosting inside the United States aims to blend in with legitimate traffic.
- Connection to Geopolitical Events: The group's pause coincided with regional tensions in February 2026, highlighting the relationship between cyber activities and political events.
- Indicators of Compromise (IoCs): Semperis has shared IoCs for the group's infrastructure and recommends organizations update their security tools and monitor suspicious Telegram traffic.
Despite the resumption of operations, data indicates that the number of victims remains limited, which may mean the group is focusing on precisely targeted attacks or facing technical difficulties in penetrating new systems.