Semperis says the long-running Iranian espionage group Prince of Persia, also tracked as Infy, has started running parts of its command-and-control (C2) infrastructure from US hosting and sending traffic over the Telegram API. For UK organisations that rely on geography-based reputation to spot hostile C2, that is a clear warning.
What happened
On 22 October 2026, researchers at the identity security firm Semperis published new findings on Prince of Persia. The Iranian state-linked group has been active for close to twenty years and is also tracked as Infy. Infosecurity Magazine reported the research the same day and SecurityWeek followed on 23 October. Both credit Tomer Bar of Semperis, who previously tracked the group at SafeBreach.
The headline finding is about where the group now hides. According to Semperis, Prince of Persia previously favoured European hosting firms and virtual private servers. In this campaign, details recovered from its newer Tornado malware led the researchers to a server at a US hosting company. SecurityWeek, summarising the research, says this is the group’s first US-based C2 server since 2016. Bar told Infosecurity Magazine that the US was “the last place we expected to find Prince of Persia hiding.”
The research also shows the group’s operating rhythm. SecurityWeek reports that after SafeBreach published on the group in February 2026, the operators took a C2 server offline and moved the rest of their infrastructure. The group then went quiet for about three months. That silence overlapped with the conflict between Iran and the US and Israel that began on 28 February, and Semperis describes it as the longest confirmed pause in the group’s history. Activity resumed on 27 May with fresh infrastructure. Within a week, according to the SecurityWeek account, the Tonnerre implant had taken more than 1,800 files from a single victim.
The group’s victims include government bodies, companies and critics of the Tehran regime across three regions: Europe, the Middle East and the US. Infosecurity Magazine describes its operations as narrowly targeted rather than mass campaigns.
The technical picture
The toolset is layered, and the layering explains why the group has lasted so long. Semperis describes three families:
- Foudre, a first-stage loader that establishes the initial foothold.
- Tonnerre, a second-stage implant that Semperis says gives the operators full surveillance capability. Infosecurity Magazine reports that the group’s malware can steal documents, take covert screenshots and capture audio from an infected machine.
- Tornado, a newer family built on the earlier codebase. It can use HTTPS or the Telegram API for C2, so its traffic resembles ordinary web or messaging activity.
The infrastructure changes are just as interesting as the malware. SecurityWeek reports that a Tornado second-stage server, probably built around 7 July, sat on Namecheap shared hosting in the US, a step away from the dedicated VPS servers the group used before. On 24 August the group began setting up another Tornado server, this time behind Cloudflare, and Semperis suspects the operators had realised their US server was exposed. Cyware’s threat briefing on the research makes the obvious point that US-hosted C2 complicates both tracking and takedown.
None of this is exotic, but it is disciplined. Shared hosting buries one malicious site among thousands of legitimate ones, a content delivery network masks the origin server, and Telegram’s API runs over TLS to infrastructure many organisations already allow. Each choice removes a signal defenders lean on, such as a suspicious country of origin or an IP address with no reputation history.
Why it matters for UK organisations
The UK sits squarely within the group’s stated area of interest. Europe is one of its three target regions, and the UK is home to Persian-language media, diaspora groups, human rights organisations and academics who work on Iran. The research names no UK victims, but the profile fits UK charities, NGOs, law firms, think tanks and universities with Iran-focused work, along with the service providers that support them.
The wider lesson applies to everyone. Many UK security stacks still lean on country of origin. Geo-blocking, proxy categories and SIEM rules often treat US hosting and Cloudflare edge addresses as low risk by default, and a state actor sitting on trusted infrastructure walks straight past that logic. If Telegram API endpoints are not on anyone’s watch list, Tornado’s C2 blends into the background.
This is also a patient adversary. A group that can go silent for three months and return with rebuilt infrastructure will treat a compromised laptop as a long-term collection post.
Expert view
When we run adversary simulation engagements, the most reliable way to stay hidden is rarely clever malware. It is choosing infrastructure the blue team has already decided to trust. Hiding behind content delivery networks, talking to legitimate SaaS APIs and using reputable shared hosting are standard red team practice because reputation-based detection struggles with them. Prince of Persia has now adopted that playbook openly, and it is a useful reminder that state actors read the same research we do.
In my experience, the organisations that catch this kind of activity are the ones that baseline behaviour rather than destinations. That means knowing which machines should ever talk to Telegram, which processes normally make outbound HTTPS calls, and what a typical upload volume looks like for a given user. Theft of 1,800 files in a week is noisy to anyone measuring outbound data per host, and invisible to a blocklist.
I would not read the US hosting as defiance. It is more likely practical: shared hosting is cheap, disposable and less visible to researchers who scan VPS ranges, which makes takedown slow and infrastructure-based attribution unreliable.
What to do now
- Pull the Semperis indicators. Load the published IoCs into EDR, SIEM and proxy tooling and search logs back to at least May 2026.
- Decide on Telegram explicitly. Semperis advises monitoring for unusual Telegram traffic. Without a business need, block Telegram API endpoints at the proxy. If there is, restrict it to named users and alert on non-browser processes calling it.
- Stop trusting destinations by reputation alone. Review rules that suppress alerts for US hosting, cloud and CDN ranges, and add behavioural detections for beaconing patterns and unusual outbound data volumes per host.
- Harden endpoints for at-risk staff. Under Cyber Essentials secure configuration and malware protection, enforce application allow-listing, block unsigned macros and scripts, and restrict microphone access for applications that have no need for it.
- Keep patching tight. Semperis advises keeping security controls and operating systems fully updated, matching the Cyber Essentials security update management control and its 14-day window for high and critical fixes.
- Brief high-risk people. Staff and partners who work on Iran, or with dissidents and diaspora communities, should get targeted phishing awareness and a clear route to report suspicious approaches.
Bottom line
Prince of Persia has not invented anything new. It has moved its C2 to places many defenders have stopped watching. For UK organisations with any Iran-related exposure, the response is to hunt for the published indicators now and to build detection around behaviour rather than geography, because trusted hosting and messaging APIs are now part of this actor’s normal toolkit.
