Science & Tech · Cybersecurity · 2 hrs ago
Iranian Hacking Group Used a US Server for Cyber-Espionage
Iran-linked hacking group Prince of Persia used a server in the US to support its cyber-espionage operations.
The group, also known as Infy, has operated for nearly 20 years and targets Iranian dissidents and organizations in the US, Europe and the Middle East.
After a confirmed three-month pause, it resumed operations on May 27, according to researchers at cybersecurity company Semperis.
Within a week, one of its malware programs stole more than 1,800 files from a single victim.
A newer malware program can use Telegram to steal files and hide its communications among ordinary internet traffic.
Researchers say the number of known victims remains small, which may mean the group is focusing on selected targets or having trouble breaking into new systems.
Semperis advises organizations to monitor unusual Telegram traffic and add the group’s identified server details to their security tools.
The Iranian-linked Prince of Persia hacking group used a command-and-control server hosted in the United States, according to researchers at Semperis.
Researchers said this was the first time the group had hosted a server in the US since 2016; another report described it as the first such identification in at least 12 years.
The group’s operations resumed on May 27 after a three-month halt, and data theft restarted.
Within seven days of the resumption, the group’s Tonnerre malware had taken more than 1,800 files from one victim.
Semperis said the group began setting up another Tornado server behind Cloudflare on August 24, possibly after realizing the US-hosted server had been exposed.
- Who
- Prince of Persia, an Iranian government-sponsored hacking group also known as Infy.
- What
- It used a command-and-control server hosted in the US to support cyber-espionage and malware operations.
- When
- The group’s operations resumed on May 27, 2026; a US-hosted server was identified in August.
- Where
- The server was hosted in the United States.
- Why
- The server supported the group’s malware and cyber-espionage campaigns. The reason it chose US hosting is not stated.
This story does not have two clearly opposing sides.
The group took a command-and-control server offline after SafeBreach published a report, then relocated its other servers.
War between Iran, the US and Israel broke out during the group’s operational pause.
Prince of Persia resumed operations with a new command-and-control server, and data theft restarted.
A server later identified in August was likely built on this date, according to Semperis.
Semperis identified a US-hosted server supporting the second stage of Tornado.
The group began setting up another Tornado second-stage server behind Cloudflare.
- Group
- Prince of Persia, also known as Infy
- US server
- First identified by Semperis as hosted in the US since 2016
- Resumption
- May 27, 2026
- Stolen files
- More than 1,800 files from one victim within seven days
- Malware
- Tornado can steal files through a Telegram bot
2 sources
What people are saying
This is the last place we expected to find Prince of Persia hiding
This isn’t unusual given that geopolitical conflict involving Iran leads to downtime with the threat group.
This is the last place we expected to find Prince of Persia hiding.