Threats · 7h ago
Semperis says Prince of Persia (Infy) resumed operations on May 27 after a confirmed three-month pause, restarting data theft and later placing a server supporting Tornado’s second stage on US shared hosting for the first time since 2016.
Rather than rent a dedicated virtual private server, the group used Namecheap shared hosting alongside thousands of unrelated domains, including legitimate sites. That makes country- or provider-based blocking less reliable: a US address does not make the server benign, while blocking the provider can catch unrelated sites. Semperis says Tonnerre stole more than 1,800 files from one victim within seven days of the restart.
Semperis describes the victim count as small, consistent with targeted activity rather than broad compromise. For teams that use geography or provider as a proxy for trust, a US address no longer rules out this actor’s command infrastructure; provider-wide blocking can also affect legitimate sites sharing the host.
1 source covering this story
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.
Part of the PlainSec briefing for 2026-10-23