# Iran-Linked Prince of Persia Runs Command Server on US Shared Hosting - URL: https://usa-24.com/prince-of-persia-apt-us-hosting/ - Publisher: USA 24 - Section: Cybersecurity - Published: 2026-10-23T13:37:52.898Z - Updated: 2026-10-23T13:37:52.903Z - Topics: Prince of Persia, Iranian Hackers, Cyber Espionage, Command-and-Control, Threat Intelligence > Semperis says the Iran-linked Prince of Persia APT ran a command-and-control server on US shared hosting, its first American C2 since 2016. Defenders should check logs now. ## Key takeaways - Semperis published its findings on October 22, 2026, describing a Prince of Persia command-and-control server on US shared hosting. - The Tornado server marks the group's first US-based C2 since 2016, after a three-month lull that SecurityWeek describes as its longest silence in nearly two decades. - Prince of Persia, also tracked as Infy, has operated for about two decades and focuses on espionage and data theft rather than destructive attacks. - The operators moved to shared hosting, changed their remote management panel and built new infrastructure behind Cloudflare, while using Telegram API channels and domain-generation algorithms. - Semperis recommends updating operating systems and security controls, monitoring unusual Telegram traffic and checking logs against its published indicators of compromise. An Iran-linked hacking group has set up a command-and-control server on American shared hosting, its first US-based server since 2016. Semperis published the findings on October 22, 2026, and attributes the activity to Prince of Persia APT, which it describes as an Iranian nation-state-sponsored group. Semperis researcher Tomer Bar has tracked the group for about 10 years, according to the company. The timing is part of the story. Prince of Persia went quiet after the Iran war with the United States and Israel began on February 28, 2026, according to Semperis's [release on PR Newswire](http://www.prnewswire.com/news-releases/semperis-researcher-discovers-an-iranian-nation-state-sponsored-threat-group-operating-command-and-control-infrastructure-in-the-united-states-302916309.html). [SecurityWeek](https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016/) describes the lull that followed as three months long, and says it was a longer silence than any other in the group's nearly two-decade history. ## What the Prince of Persia APT did on US shared hosting Semperis describes a Tornado command-and-control server running on US shared hosting. The company says it found the server in August 2026. SecurityWeek reports that the group restarted operations on May 27 with the deployment of a new C&C server, and that data theft resumed. The dates fit together but do not form a complete timeline. SecurityWeek says the server was used this year, while Semperis points to August as the moment its researchers found it. The exact activity window is not fully public, so defenders should treat these dates as a starting point for log searches rather than a settled history. The deployment also closes a long gap. Semperis places the group's previous US-based server in 2016, so the 2026 server marks a return to American infrastructure after about a decade. ## Why moving to US hosting changes the picture Hosting in the United States is a shift for this group. Semperis says Prince of Persia had relied on European hosting and virtual private servers. Moving onto shared hosting puts its command infrastructure with different providers, abuse desks and legal jurisdictions, which changes where a takedown request or abuse complaint would have to land. That matters most for the people the group goes after. SecurityWeek reports that its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe and the Middle East. Semperis identifies Iranian dissidents living in the US as the primary victims, so a command server on American soil gives the operators reach into the same country where those people live. [Iran International](https://www.iranintl.com/en/202610237124) covered the research as a case of Iranian state-linked hackers using a US server to target dissidents. It notes that the group is also tracked as Infy. The sources read point to espionage and data theft, not destructive attacks. ## How the group changed its infrastructure to avoid detection Semperis says the operators moved their infrastructure to avoid detection. They shifted to shared hosting, changed their remote management panel and began building new infrastructure behind Cloudflare. Fronting servers with Cloudflare hides the origin address behind the content delivery network, so a defender who searches for a server's IP address alone may not find it. The tooling changed as well. According to Semperis, the group now uses Telegram API channels, domain-generation algorithms and blockchain-based exfiltration to keep its command infrastructure resilient. Domain-generation algorithms produce long lists of candidate domain names, so blocking one domain does not stop the operators. Blockchain-based exfiltration gives the group another route for moving stolen data, and defenders need to account for it. ## Tornado malware and Telegram-based file theft [Mallory](https://mallory.ai/stories/01a16247-6516-7a36-85f6-944626b5b848) reports that Tornado malware can steal files through Telegram bots. That makes Telegram traffic a practical place to look. A server or workstation that starts talking to Telegram's API without a business reason deserves a closer look, especially if it also reaches unfamiliar hosts. The Telegram dependence is what makes these operations hard to block cleanly. Blocking the platform outright would disrupt legitimate use in many organizations, so defenders need behavioral rules that separate ordinary messaging from command traffic. The wider war provides context. [Wikipedia's entry on cyberwarfare during the 2026 Iran war](https://en.wikipedia.org/wiki/Cyberwarfare_during_the_2026_Iran_war) describes digital and information operations conducted by Israel, the United States, Iran and affiliated hacktivist groups. The sources read do not tie this Prince of Persia infrastructure to a specific wartime operation, so the context explains the timing without proving intent. ## Who is exposed and what remains unknown The victims are not named in the sources read. It is unclear which US organizations, if any, were hit through this infrastructure. Attribution rests on Semperis's research, and no US government advisory on this activity appeared in the sources reviewed. Two other questions remain open. Neither Semperis nor the coverage reviewed says whether the US hosting provider was notified or took action. The sources also do not confirm any breaches tied to this server, which leaves the scope of the campaign unclear. Consumers have no specific action from this report. Standard hygiene still applies: avoid suspicious links, keep devices patched and be wary of unexpected downloads or messages. ## What security teams should do this week Semperis recommends that defenders update operating systems and security controls and monitor for unusual Telegram traffic. These steps turn that advice into concrete work: - Confirm operating systems and security controls are current on internet-facing servers first, then on internal endpoints. - Flag hosts that contact Telegram's API without a business reason, and review what data those hosts sent. - Download the indicators of compromise from the Semperis post and search firewall, proxy and endpoint logs for them. Semperis says it shared IoCs for defensive use. - Compare outbound connections to unfamiliar shared-hosting addresses and Cloudflare-fronted domains against your approved list. - Record the time windows you search, since the exact activity window is not fully public. Patching discipline matters beyond this campaign. Attackers keep going after internet-facing gateways, as shown by a [Citrix NetScaler zero-day that is still planting web shells on US VPN gateways](https://usa-24.com/cve-2026-88771-netscaler-zero-day-exploit/). Edge devices need the same advisory tracking as workstations. ## What to watch next Three developments would clarify this story. The first is whether a US government agency issues an advisory, which would test Semperis's attribution against independent findings. The second is whether the US hosting provider responds, since its action or silence will shape how quickly the server disappears. The third is whether any US victims come forward. If the published indicators surface in other investigations, that would suggest the group's tooling is shared more widely than current reporting shows. ## Frequently asked questions ### Who is Prince of Persia? Semperis describes Prince of Persia APT as an Iranian nation-state-sponsored hacking group. Iran International reports that it is also tracked as Infy and has operated for about two decades. Its targets are mostly Iranian dissidents, along with government and private entities in the US, Europe and the Middle East. ### What did Semperis find about the group's US server? Semperis reported a Tornado command-and-control server on US shared hosting, which it says it found in August 2026. The company published its findings on October 22, 2026. It describes the server as the group's first US-based C2 since 2016, and says the operators moved to Cloudflare-fronted infrastructure. ### Should ordinary users worry about this campaign? Semperis's research asks no specific action from consumers. Standard hygiene still applies, including avoiding suspicious links, keeping devices patched and being careful with unexpected downloads. The most direct exposure falls on Iranian dissidents and on organizations in the group's target set. ### Has the US government issued an advisory on this activity? No US government advisory on this activity appeared in the sources reviewed. Attribution currently rests on Semperis's research. Organizations should watch for federal guidance as the story develops. ## Sources 1. [Iran's Prince of Persia APT Hosts C&C in US for First Time Since 2016 - SecurityWeek](https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016/) 2. [Semperis Researcher Discovers an Iranian Nation-State-Sponsored Threat Group Operating Command-and-Control Infrastructure in the United States - PR Newswire](http://www.prnewswire.com/news-releases/semperis-researcher-discovers-an-iranian-nation-state-sponsored-threat-group-operating-command-and-control-infrastructure-in-the-united-states-302916309.html) 3. [Iranian state-linked hackers used US server to target dissidents, researchers say - Iran International](https://www.iranintl.com/en/202610237124) 4. [Iranian Prince of Persia Group Resumes Espionage Using US-Hosted C2 - Mallory](https://mallory.ai/stories/01a16247-6516-7a36-85f6-944626b5b848) 5. [Cyberwarfare during the 2026 Iran war - Wikipedia](https://en.wikipedia.org/wiki/Cyberwarfare_during_the_2026_Iran_war)