Iranian Prince of Persia Group Resumes Espionage Using US-Hosted C2

Iranian espionage group Prince of Persia resumed observed data exfiltration in May after an approximately three-month operational interruption, according to Semperis research. The group, active for roughly two decades, targets Iranian dissidents and public- and private-sector organizations across the United States, Europe, and the Middle East. Its campaigns use Foudre, Tonnerre, and Tornado malware for infection, surveillance, and data theft; Tonnerre reportedly exfiltrated more than 1,800 files from one victim during the first week of resumed activity.

Researchers identified replacement command-and-control infrastructure, including a Tornado second-stage server on US-based Namecheap shared hosting—a departure from the group's established hosting practices. The actor subsequently deployed infrastructure behind Cloudflare and continued rotating domains and servers. Domain generation, RSA authentication, and Tornado communications over HTTPS and the Telegram API complicate monitoring and disruption by blending malicious activity with legitimate traffic. Semperis recommended updating operating systems and security controls and monitoring unusual Telegram traffic.