# Iranian 'Prince of Persia' (Infy) APT Hosts Tornado/Foudre/Tonnerre C2 on US Shared Hosting Behind Cloudflare

> Semperis (Tomer Bar) reports that the Iranian state-sponsored Prince of Persia (Infy) group, active for about two decades, stood up Tornado/Foudre/Tonnerre C2 on US soil (Namecheap shared hosting at 68.65.122.203, July 2026, later Cloudflare-fronted), the first US-hosted C2 from the group in about a decade. The malware targets Iranian dissidents plus US, European and Middle Eastern public- and private-sector organizations for long-term surveillance and document theft.

- **Published:** 2026-10-23T00:05:40Z
- **Last reviewed:** 2026-10-23T06:57:45.767Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4199
- **ID:** TL-2026-4199
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Infy (Iran)
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Prince of Persia (also tracked as Infy) is one of the oldest APT groups, with activity traced to 2004 and earlier public reporting by Palo Alto Unit 42 (2016) and Check Point (2021). Its toolset is a French-named malware family: Foudre (first-stage downloader and victim profiler, distributed via phishing and booby-trapped Office/archive lures), Tonnerre (second-stage espionage implant capable of document theft, screenshot and audio capture, Telegram integration), and, most recently, Tornado (v51), which is built on the Foudre codebase and uses both HTTPS and the Telegram API as C2 channels. Related tooling documented by SafeBreach includes MaxPinner (Telegram data theft), AmaqFinder, Rugissement and a Deep Freeze variant.

Semperis reports that the group went dark on or around 2026-02-28 (coinciding with US/Israeli strikes on Iran), after SafeBreach published its research on 2026-02-04 and the actor shut down the C2 at 45.80.148.249 within about a week (2026-02-09), removing victim machine GUIDs from updatelist.txt. Activity resumed 2026-05-27 after a three-month pause, described as the longest hiatus in two decades of tracking. The first Tornado C2 domain was registered 2026-05-31; a DGA domain followed 2026-06-01. On 2026-07-07 a new C2 server at 68.65.122.203 (AS22612, Namecheap, cPanel shared hosting) became operational, the first US-hosted C2 attributed to the group in about 10 years (Semperis notes a prior instance in 2016). Semperis discovered it in August 2026. From 2026-08-24 the infrastructure was also fronted by Cloudflare (162.159.24.80). Earlier 2026 infrastructure used European HOSTGW SRL VPS at 185.244.129.70 and 185.244.129.123 with a CyberPanel management interface, and 2025 infrastructure sat in 45.80.148.0/24, 45.80.149.0/24 and 45.80.151.0/24. Semperis observed over 1,800 files exfiltrated from a single victim in the first week of activity, with exfiltration logged on 2026-08-19; the low victim count suggests targeted operations.

Tradecraft per SafeBreach/Semperis: phishing delivery with macro-enabled Excel lures and, in newer chains, WinRAR one-day exploit archives that drop an SFX masquerading as a document and place AudioService.exe in the startup folder (SafeBreach says the CVE is likely CVE-2025-8088 or CVE-2025-6218, not confirmed); loader DLLs run through rundll32 (e.g. conf8830.dll, AuthFWSnapin.dll, reg7989.dll); a two-phase DGA with week-based seeds (e.g. prefix <yy><m><week>G<n> for Foudre, F<n> for Tonnerre; custom alphabet 'otdhpgaurxyvszmqlwckbfniej') on .site, .hbmc.net, .privatedns.org, .ix.tc and ddns domains; daily RSA-signed .sig validation files that prevent analysts from sinkholing or taking over C2; blockchain-based C2 obfuscation (domains hidden in Bitcoin OP_RETURN data read via blockchain.info); and Telegram bot/group C2 with configuration (tga.adr) pulled from the C2 backend and gated to whitelisted machine GUIDs. SafeBreach also documented a 'strike-back' ZZ Stealer / StormKitty-fork lure aimed at researchers analysing the group, and shared tooling with Educated Manticore plus a possible link to APT33 via Remcos use (SafeBreach correlations, not attribution). SafeBreach assessed the group's response to the January 2026 Iranian internet blackout (dormant 2026-01-08 to 2026-01-24, C2 preparation 2026-01-25/26, Iranian internet restored 2026-01-27) as strong evidence of operation by the Iranian regime.

Primary victims are Iranian dissidents and regime opponents; Semperis also lists US public/private sector, European and Middle Eastern organizations. Source-recommended mitigations: update security controls with the published IOCs, monitor unusual Telegram traffic, and keep operating systems fully patched. The Infosecurity Magazine article itself lists no IOCs and does not name the hosting provider; the provider (Namecheap) and IOCs come from the Semperis research post.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1566 Phishing
- T1059.005 Visual Basic
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1218.011 System Binary Proxy Execution: Rundll32
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1056.001 Input Capture: Keylogging
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1113 Screen Capture
- T1123 Audio Capture
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1001 Data Obfuscation
- T1566.001 Phishing
- T1566.002 Phishing
- T1059.001 Command and Scripting Interpreter
- T1053.005 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1573.002 Encrypted Channel

## Sources

- [Iranian Hacking Group Found Hosting C2 Infrastructure in the US (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/iranian-hacking-group-hosting-c2/)
- [Prince of Persia Threat Group Hiding in Plain Sight (Semperis)](https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/)
- [Semperis Researcher Discovers an Iranian Nation-State-Sponsored Threat Group Operating C2 Infrastructure in the United States (PR Newswire)](http://www.prnewswire.com/news-releases/semperis-researcher-discovers-an-iranian-nation-state-sponsored-threat-group-operating-command-and-control-infrastructure-in-the-united-states-302916309.html)
- [Semperis traces Prince of Persia command server to U.S. shared hosting (Runtime Wire)](https://runtimewire.com/article/semperis-prince-of-persia-us-command-server)
- [Prince of Persia: A Decade of an Iranian Nation-State APT Campaign Activity (SafeBreach)](https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity)
- [An Update on the Prince of Persia Threat Actor (SafeBreach, Part II)](https://www.safebreach.com/blog/prince-of-persia-part-ii/)
- [Iranian Infy APT Resurfaces with New Malware Activity (The Hacker News)](https://thehackernews.com/2025/12/iranian-infy-apt-resurfaces-with-new.html)
- [After Lightning Comes Thunder (Check Point Research)](https://research.checkpoint.com/2021/after-lightning-comes-thunder)
- [Iranian APT Prince of Persia returns with new malware and C2 infrastructure (CSO Online)](https://www.csoonline.com/article/4109985/iranian-apt-prince-of-persia-returns-with-new-malware-and-c2-infrastructure.html)
- [Iran's APTs and the U.S. Enterprise in 2026: Prince of Persia (Infy) (KELA)](https://www.kelacyber.com/blog/irans-apts-and-the-us-enterprise-in-2026-prince-of-persia-infy/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4199