Threat reportAPTTL-2026-4199
Iranian 'Prince of Persia' (Infy) APT Hosts Tornado/Foudre/Tonnerre C2 on US Shared Hosting Behind Cloudflare
Iranian 'Prince of Persia' (Infy) APT Hosts (TL-2026-4199), also tracked as Infy, is a high-severity advanced persistent threat campaign, first published 2026-10-23. It is attributed to Infy (Iran) with high confidence, affects Microsoft Windows (endpoints targeted by Foudre/Tonnerre/Tornado), maps to 29 MITRE ATT&CK techniques (T1001, T1005, T1027), and is covered by 9 detection rules and 45 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 29MITRE ATT&CK
- Actors
- 1Infy
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 45Indicators of compromise
Key facts for TL-2026-4199
- Threat ID
- TL-2026-4199
- Also known as
- Infy, Prince of Persia, Foudre, Tonnerre, Tornado
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Infy
- Attribution confidence
- HIGH
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government administration, private-sector, civil society, academia, news - media, dissidents
- Target regions
- iran, North America, Europe, Middle East
- Detection rules
- 9
- Indicators of compromise
- 45
- Updates
- 2026-10-23 · revalidated 1× · latest source
Malware and tooling in Iranian 'Prince of Persia' (Infy) APT Hosts
Malware and tooling: Infy, Tonnerre, Tornado, ttestro1bot
How Iranian 'Prince of Persia' (Infy) APT Hosts works
Semperis (Tomer Bar) reports that the Iranian state-sponsored Prince of Persia (Infy) group, active for about two decades, stood up Tornado/Foudre/Tonnerre C2 on US soil (Namecheap shared hosting at 68.65.122.203, July 2026, later Cloudflare-fronted), the first US-hosted C2 from the group in about a decade. The malware targets Iranian dissidents plus US, European and Middle Eastern public- and private-sector organizations for long-term surveillance and document theft.
Prince of Persia (also tracked as Infy) is one of the oldest APT groups, with activity traced to 2004 and earlier public reporting by Palo Alto Unit 42 (2016) and Check Point (2021). Its toolset is a French-named malware family: Foudre (first-stage downloader and victim profiler, distributed via phishing and booby-trapped Office/archive lures), Tonnerre (second-stage espionage implant capable of document theft, screenshot and audio capture, Telegram integration), and, most recently, Tornado (v51), which is built on the Foudre codebase and uses both HTTPS and the Telegram API as C2 channels. Related tooling documented by SafeBreach includes MaxPinner (Telegram data theft), AmaqFinder, Rugissement and a Deep Freeze variant.
Semperis reports that the group went dark on or around 2026-02-28 (coinciding with US/Israeli strikes on Iran), after SafeBreach published its research on 2026-02-04 and the actor shut down the C2 at 45.80.148.249 within about a week (2026-02-09), removing victim machine GUIDs from updatelist.txt. Activity resumed 2026-05-27 after a three-month pause, described as the longest hiatus in two decades of tracking. The first Tornado C2 domain was registered 2026-05-31; a DGA domain followed 2026-06-01. On 2026-07-07 a new C2 server at 68.65.122.203 (AS22612, Namecheap, cPanel shared hosting) became operational, the first US-hosted C2 attributed to the group in about 10 years (Semperis notes a prior instance in 2016). Semperis discovered it in August 2026. From 2026-08-24 the infrastructure was also fronted by Cloudflare (162.159.24.80). Earlier 2026 infrastructure used European HOSTGW SRL VPS at 185.244.129.70 and 185.244.129.123 with a CyberPanel management interface, and 2025 infrastructure sat in 45.80.148.0/24, 45.80.149.0/24 and 45.80.151.0/24. Semperis observed over 1,800 files exfiltrated from a single victim in the first week of activity, with exfiltration logged on 2026-08-19; the low victim count suggests targeted operations.
Tradecraft per SafeBreach/Semperis: phishing delivery with macro-enabled Excel lures and, in newer chains, WinRAR one-day exploit archives that drop an SFX masquerading as a document and place AudioService.exe in the startup folder (SafeBreach says the CVE is likely CVE-2025-8088 or CVE-2025-6218, not confirmed); loader DLLs run through rundll32 (e.g. conf8830.dll, AuthFWSnapin.dll, reg7989.dll); a two-phase DGA with week-based seeds (e.g. prefix <yy><m><week>G<n> for Foudre, F<n> for Tonnerre; custom alphabet 'otdhpgaurxyvszmqlwckbfniej') on .site, .hbmc.net, .privatedns.org, .ix.tc and ddns domains; daily RSA-signed .sig validation files that prevent analysts from sinkholing or taking over C2; blockchain-based C2 obfuscation (domains hidden in Bitcoin OP_RETURN data read via blockchain.info); and Telegram bot/group C2 with configuration (tga.adr) pulled from the C2 backend and gated to whitelisted machine GUIDs. SafeBreach also documented a 'strike-back' ZZ Stealer / StormKitty-fork lure aimed at researchers analysing the group, and shared tooling with Educated Manticore plus a possible link to APT33 via Remcos use (SafeBreach correlations, not attribution). SafeBreach assessed the group's response to the January 2026 Iranian internet blackout (dormant 2026-01-08 to 2026-01-24, C2 preparation 2026-01-25/26, Iranian internet restored 2026-01-27) as strong evidence of operation by the Iranian regime.
Primary victims are Iranian dissidents and regime opponents; Semperis also lists US public/private sector, European and Middle Eastern organizations. Source-recommended mitigations: update security controls with the published IOCs, monitor unusual Telegram traffic, and keep operating systems fully patched. The Infosecurity Magazine article itself lists no IOCs and does not name the hosting provider; the provider (Namecheap) and IOCs come from the Semperis research post.
MITRE ATT&CK techniques used in TL-2026-4199
Command and Control
T1001 Data Obfuscation; T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1573.002 Encrypted Channel
Collection
T1005 Data from Local System; T1113 Screen Capture; T1119 Automated Collection; T1123 Audio Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.011 System Binary Proxy Execution: Rundll32; T1497 Virtualization/Sandbox Evasion
Persistence
T1053.005 Scheduled Task/Job; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1056.001 Input Capture: Keylogging; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
Execution
T1059.001 Command and Scripting Interpreter; T1059.005 Visual Basic; T1203 Exploitation for Client Execution; T1204.002 Malicious File
Initial Access
T1566 Phishing; T1566.001 Phishing; T1566.002 Phishing
Resource Development
Affected products and versions in Iranian 'Prince of Persia' (Infy) APT Hosts
Remediation for Iranian 'Prince of Persia' (Infy) APT Hosts
Patches
- Fully patch operating systems and update WinRAR to the latest release (SafeBreach cites likely CVE-2025-8088 / CVE-2025-6218, unconfirmed)
Immediate actions
- Load the Semperis/SafeBreach IOCs (C2 IPs, DGA domains, hashes) into DNS, proxy, firewall and EDR blocklists
- Hunt for outbound connections to api.telegram.org from hosts that have no business using Telegram
- Hunt for DNS queries to short-lived .site, .hbmc.net, .privatedns.org, .ix.tc and ddnsking.com/ddns.net domains matching the documented DGA patterns
- Hunt for AudioService.exe in user Startup folders and rundll32.exe loading conf8830.dll, AuthFWSnapin.dll or reg7989.dll
Workarounds
- Block or restrict Telegram API access where not required
- Do not extract archives from untrusted senders with unpatched WinRAR
Longer-term hardening
- Alert on blockchain.info rawaddr lookups from non-finance endpoints
- Restrict macro execution from internet-origin Office files
- Provide targeted-user protection and awareness for dissidents, academics and diaspora communities
Timeline of Iranian 'Prince of Persia' (Infy) APT Hosts
- SafeBreach (with Palo Alto Networks) publishes Part I on Prince of Persia: new Foudre v34 / Tonnerre v17 / v50 variants, DGA, RSA signature validation and Telegram C2 (bot ttestro1bot, operator @ehsan8999100).
- After the Part I publication the actor replaces its Telegram operator account and activates new C2 server 45.80.148.249.
- Group goes fully dormant during the Iranian internet blackout (until 2026-01-24); C2 preparation resumes 2026-01-25/26 and Iranian internet is restored 2026-01-27, which SafeBreach cites as evidence of regime control.
- SafeBreach publishes Part II describing Tornado v51, WinRAR one-day exploit delivery, blockchain-based C2 obfuscation and the ZZ Stealer strike-back campaign.
- Actor shuts down C2 45.80.148.249, activates replacement 45.80.148.194 and removes victim machine GUIDs from updatelist.txt.
- Group goes dark as US/Israeli strikes on Iran begin; last domain registration before the pause was 2026-02-25.
- Activity resumes after a roughly three-month hiatus, the longest in two decades of documented activity.
- First Tornado C2 domain (xleergjemlwm.hbmc.net) registered; DGA domain nnahinsmqs.site generated 2026-06-01 on former primary server 185.244.129.70.
- New C2 server 68.65.122.203 (AS22612, Namecheap shared hosting with cPanel) becomes operational, the first US-hosted Prince of Persia C2 in about a decade.
- Active victim exfiltration logged; over 1,800 files taken from a single victim in the first week of activity.
- Cloudflare-fronted C2 infrastructure (162.159.24.80, domain olbkdmwhacbfc.privatedns.org) deployed; Semperis discovers the US-hosted server in August 2026.
- Additional primary C2 server 185.244.129.123 (HOSTGW SRL) activated.
- Semperis (Tomer Bar) publishes 'Prince of Persia Threat Group Hiding in Plain Sight'; Infosecurity Magazine reports the US-hosted C2 findings.
Update history for TL-2026-4199
- 2026-10-23 — Iran's Prince of Persia (Infy) APT Hosts C2 in US for First Time Since 2016 - Tornado and Tonnerre Malware: What changed No severity, exploitability or status change; all key fields already match the existing record. New indicators (7) 4 new C2 domains (aa58862c.ddns.net, roounvuq.space, kbbpissmqs.hbmc.net, vssmqppaup.conningstone.net), 1 new SH
Sources cited for Iranian 'Prince of Persia' (Infy) APT Hosts
- Iranian Hacking Group Found Hosting C2 Infrastructure in the US (Infosecurity Magazine)
- Prince of Persia Threat Group Hiding in Plain Sight (Semperis)
- Semperis Researcher Discovers an Iranian Nation-State-Sponsored Threat Group Operating C2 Infrastructure in the United States (PR Newswire)
- Semperis traces Prince of Persia command server to U.S. shared hosting (Runtime Wire)
- Prince of Persia: A Decade of an Iranian Nation-State APT Campaign Activity (SafeBreach)
- An Update on the Prince of Persia Threat Actor (SafeBreach, Part II)
- Iranian Infy APT Resurfaces with New Malware Activity (The Hacker News)
- After Lightning Comes Thunder (Check Point Research)
- Iranian APT Prince of Persia returns with new malware and C2 infrastructure (CSO Online)
- Iran's APTs and the U.S. Enterprise in 2026: Prince of Persia (Infy) (KELA)
Detection coverage for TL-2026-4199
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4199 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.