A group that works for the Iranian government and tracks dissidents is active again, and this time one of its control servers sat on American commercial hosting for the first time since 2016.
Researchers at Semperis followed Prince of Persia, which some vendors log as Infy, through the longest gap it has ever shown in roughly twenty years of work. Its operators pulled their infrastructure down shortly after SafeBreach released a February 2026 analysis, then relocated whatever remained. Nothing moved for three months, a stretch that lined up with the Iran-US-Israel conflict that opened on February 28.
Back online in May
Activity returned on May 27 with a new control node, and data-taking came back with it. Tonnerre, one of the family’s toolkits, removed more than 1,800 files from a single target inside a week. Victim numbers are still modest; Tomer Bar, who leads security research at Semperis and handled the same group at SafeBreach, said that could mean disciplined targeting or poor luck at breaking into fresh networks.
By August Bar had spotted another host, assembled around July 7, that runs the second stage of Tornado, the crew’s current malware. Its tricks include shipping stolen material out via a Telegram bot. For this box the operators ditched virtual private servers for Namecheap shared hosting, whose servers hold thousands of domains.
What comes next
Whom they go after has not changed either, Bar said. The bulk are Iranian dissidents, and state bodies and private firms in Europe, the Middle East and America are also in scope. On August 24 a further second-stage server went up behind Cloudflare, which Semperis reads as the crew reacting to exposure. It has published indicators and urges teams to load them and flag suspicious Telegram traffic.
