Tomer Bar | AVP of Security Research AVP of Security Research

For nearly two decades, the Iranian nation-state threat actor Prince of Persia has been an active cyber threat, primarily attacking Iranian dissidents and public and private sector organizations in the United States, Europe, and the Middle East. Initially reported in 2016 by Palo Alto Networks’ Unit 42, this Advanced Persistent Threat (APT) group covered its tracks and changed strategies in February 2026, following the most recent published research on its activities. This blog post summarizes Prince of Persia’s actions since then and describes how we were able to track and monitor the threat actor’s activity, including a shift in its Command and Control (C2) server strategy.


What is Prince of Persia?

Security researchers (including myself) have been monitoring Prince of Persia’s activity since its discovery in February 2016. Since 2010, this APT group has launched numerous malware attacks:

  • Operation Mermaid, which began activity in 2010, targeted Danish diplomats, and is suspected of being an early iteration of Prince of Persia
  • Infy, the group’s foundational malware family, first exposed globally around 2016
  • Foudre, a first-stage malware introduced following the takedown of Infy
  • Tonnerre, a second-stage malware that includes full surveillance capabilities
  • Tornado, the newest malware, which builds on the older malware codebase and includes new capabilities such as a Telegram-based C2 channel and advanced Domain Generation Algorithms (DGAs)

In my previous role as head of the SafeBreach Labs team, I conducted extensive research on the group. To fully understand its past activities, I recommend reviewing that research, published in December 2025 and February 2026. Here is a brief summary of Prince of Persia’s tools and tactics.


What is Infy?

Infy functions as a full-featured espionage tool. Its high-end variant, known as Infy M, features a hidden graphical user interface (GUI) control panel and HTTP/FTP capabilities. This variant also supports remote execution commands, handled via backend scripts.

After publishing its Infy research in 2016, Unit 42 conducted a takedown operation, which severed the attack group’s access to most of its victims. This process also provided information about Prince of Persia’s victims, motive, and attack scope.

As a result, Unit 42 affirmed the group’s connection to Iran, as most victims were in the country or were Iranian dissidents. In addition, the group did not seem to be financially motivated (a hallmark of nation-state actors).

Subsequent research by Claudio Guarnieri and Collin Anderson reaffirmed this connection:

  • Prince of Persia compromised two news websites related to Jundallah, also known as the People’s Resistance Movement of Iran, as early as 2010. The threat group exploited ActiveX vulnerabilities to attack the websites’ visitors.
  • Prince of Persia activity around the 2013 Iranian Presidential elections targeted the press, including BBC Persian. The group also attacked civil society members and activists.
  • After Unit 42’s takedown of the group, the Telecommunication Company of Iran blocked and redirected any traffic originating from Iran aimed at Palo Alto’s sinkholes. Guarnieri and Anderson suspected that this was a deliberate attempt to reduce visibility and regain control of the group’s victims and further supported the theory that the group is connected to the Iranian government.

What is Foudre?

In August 2017, Unit 42 again observed Prince of Persia activity was observed again, this time through new malware dubbed Foudre (“lightning”). Foudre serves as first-stage malware and is used to:

  • Map victims’ identities
  • Conduct the initial compromise
  • Establish persistent access
  • Perform basic host reconnaissance
  • Perform file manipulation, keystroke logging, and browser credential theft
  • Profile infected systems to determine whether they are valuable enough for further infection

What is Tonnerre?

In 2018, Foudre version 8 introduced a new malware variant: Tonnerre (“thunder”). The two variants work together. If a victim is deemed important enough, Foudre downloads and executes Tonnerre.

Tonerre provides deep data exfiltration The malware captures audio, takes screenshots, and systematically extracts sensitive documents. More recent iterations use a DGA and integrate Telegram bots and private channels as a fallback mechanism for stealthy C2 purposes.

Together, Foudre and Tonnerre function as a dual-protocol infostealer that communicate through both traditional HTTP and native Telegram API channels. Tonnerre sweeps for localized credentials, cookies, and system environment information. It also uses aggressive mechanisms like anti-takeover RSA signatures to prevent cybersecurity researchers from sinkholing its traffic.


What is Tornado?

In February 2026, SafeBreach discovered Tornado, a malware variant that operates as part of Prince of Persia’s multi-stage ecosystem. Dropped into target environments via one-day software vulnerabilities (e.g., WinRAR exploits), Tornado uses both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate network traffic to bypass firewalls. The Telegram API key and chat ID are not embedded in the malware code; rather, the malware can pull in the key and ID based on its C2 backend configuration.

Tornado uses DGA to constantly cycle through active domains, maintaining a highly resilient management infrastructure. The malware also supports blockchain-based exfiltration by decoding specific transaction-hidden fields, enabling the bad actors to arbitrarily change C2 routing infrastructure on the blockchain without pushing a code update to infected victims. To avoid detection, Tornado uses specific attack techniques designed to circumvent endpoint protection.

Prince of Persia implemented RSA signature validation in Tornado attacks to strictly authenticate incoming C2 requests. This tactic locks out security researchers and automates scanners that attempt to map the threat group’s network and victims’ heatmaps.


Where is Prince of Persia hiding in plain sight?

As of February 2026, the most recent known public version of Foudre was version 34. The most recent known public version of Tonnerre was version 17. The most recent version of Tornado first- and second-stage malware was version 51.

However, at that time, the Tornado second-stage malware binary was not publicly available for analysis. The C2 server vanished in September 2025, and the threat group moved all its other C2 servers to an unknown location after the publication of SafeBreach’s February 2026 research.

Since March 2026, Prince of Persia has gone dark, with no publicly identified activity. However, we were able to track and monitor the group’s activity, including a shift in its C2 server strategy:

  • Prince of Persia abounded the known C2 servers and built a new bank of active C2 servers.
  • The group changed the hosting providers from Europe to new providers.
  • Prince of Persia changed its remote panel managements and shifted from Virtual Private Server (VPS) hosting to public hosting, alongside both benign sites and malicious sites operated by other threat actors.

We have discovered active C2 servers for all the group’s known malware: Foudre, Tonnerre, and Tornado (for both the first- and second-stage malware families).

But most importantly, our discovery of the Tornado second-stage C2 server reveals that for the first time in a decade, the Iranian threat actor decided to host its new C2 server on US soil — at the same time as the beginning of the recent hostilities between Iran and the United States. This is the last place we expected to find the threat actor hiding. We also found further correlations between this geopolitical conflict and the threat group’s activity.


A timeline of Prince of Persia’s current activity

Prince of Persia’s reaction to Unit 42’s research was fast.

  • Less than a week after researchers’ February 4, 2026 publication, the threat actor shut down the C2 sever at IP address 45.80.148.249.
  • On February 9, 2026, a new C2 server (45.80.148.194) became active. It seems that the threat actor rushed to action: The server was in the same known IP range of past discovered C2 servers (Figure 1). There was even a server at 45.80.148.195.
  • Also on February 9, the threat actor removed all entries of victim machine GUIDs from the updatelist.txt file in its C2 server (Figure 2). For years, the group had used this list to manage victims’ infections.
A list of Virustotal.com resolved C2 domain names
Figure 1. Virustotal.com resolved C2 domain names
Empty list of a victim's machine GUID's in the C2 server
Figure 2. Empty list of a victim's machine GUID's in the C2 server

That brings us to February 28, 2026, the beginning of the conflict between the United States and Iran. For reference as we walk through Prince of Persia’s recent activity, the following are major events in that conflicts from that date to the time of this blog’s publication:

  • February 28, 2026: US and Israeli forces launch airstrikes against Iranian missile systems, military infrastructure, and leadership.
  • March 1-10, 2026: Iran and its allies launch retaliatory strikes against regional US bases and maritime traffic.
  • April 8, 2026: A two-week ceasefire begins.
  • April 12-13, 2026: The United States enforces a naval blockade on Iran.
  • June 17, 2026: The United States and Iran sign an MoU.

Historically, geopolitical conflict involving Iran has led to C2 downtime for Prince of Persia. Indeed, as noted earlier, the threat actor’s last domain registration was on February 25. But even with Iran under active attack, the group didn’t completely desert its C2 server. It kept registering certificates until April 1, 2026 — even while the C2 server was inactive (Figure 3).

Virustotal.com SSL certificate created on April 1, 2026, for the C2 server
Figure 3. Virustotal.com SSL certificate created on April 1, 2026, for the C2 server

We saw the same pattern in another C2 server (45.80.149.3). The threat actor stopped registering new C2 servers just two days after SafeBreach’ research publication (Figure 4).

The last C2 server's domain names registered by the adversary
Figure 4. The last C2 server's domain names registered by the adversary

However, the group registered SSL certificates until mid-March 2026 (Figure 5).

Log1.com SSL certificates registrations
Figure 5. Log1.com SSL certificates registrations

This downtime lasted for three months, the longest downtime in nearly two decades of activity by the threat actor. This downtime ended on May 27, 2026.

At that time, a new C2 server (185.244.129.70) was built, and exfiltration began to C2 domain name aa58862c.ddns.net. We were able to detect this activity in near-real time (Figure 6). In the first week alone, Tonnerre exfiltrated more than 1,800 files from this victim. Note: We have masked the victim details in this article due to privacy concerns.

Log of victim exfiltration including masked IP, RSA key, victim’s machine GUID, C2 domain name, and time of exfiltration
Figure 6. Log of victim exfiltration including masked IP, RSA key, victim’s machine GUID, C2 domain name, and time of exfiltration

We have been monitoring Prince of Persia’s exfiltration activity for the past six months. The number of victims remains low, which could indicate either targeted attacks or difficulties infecting new victims. The victim shown in Figure 7 is still active and has since been exfiltrated.

Log of victims infected with Tonnerre exfiltration records from August 19, 2026
Figure 7. Log of victims infected with Tonnerre exfiltration records from August 19, 2026

This C2 server commanded on both Tornado and Foudre + Tonnerre victims. The first Tornado C2 domain name, xleergjemlwm.hbmc.net, was registered on May 31, 2026.

In the same week, a second domain name, nnahinsmqs.site, was registered. This domain name was generated via the Tornado DGA algorithm, using prefix 26623G3 (<YY><M><WEEK NUMBER><G><3>). We were able to download the victim’s exfiltrated files from this C2 server (Figure 8).

June 1, 2026, C2 server response to a HTTP POST request to fdir.php, which includes a list of exfiltrated file names and sizes
Figure 8. June 1, 2026, C2 server response to a HTTP POST request to fdir.php, which includes a list of exfiltrated file names and sizes

The exfiltrated file format was L<YY><MM><DD><HH><MM><SS><VICTIM IP overwritten with zeroes>. The threat actor shifted from the 45.80.148.0/24, 45.80.149.0/24, and 45.80.151.0/24 IP ranges that it had used for years. However, it didn’t change the hosting provider; the new C2 IP address, 185.244.129.70, belongs to the same provider that Prince of Persia used previously. The C2 server is managed using Cyber Panel over port 8090, like the group’s other C2 servers over the past few years (Figure 9).

Home page of the May 2026, C2 server
Figure 9. Home page of the May 2026, C2 server

The last (and most important) missing piece was the second-stage Tornado C2 server. This is the only C2 server that hosts the tga.adr file, which can be download by specific victims and includes the API key of the Telegram bot that exfiltrates victim files to a Telegram group chat controlled by the threat actor.

This server was first detected in September 2025, hosted on the same C2 server (45.80.148.124) as Tornado’s first-stage C2 server. Only four domain names were used between July 31 and September 5, 2025 (Figure 10).

Virustotal.com C2 domain names from 2025, the Tornado domain names have privatedns.org TLD
Figure 10. Virustotal.com C2 domain names from 2025, the Tornado domain names have privatedns.org TLD

After that date, the second-stage C2 server vanished. We believed (but could not prove) that it remained active under an unknown IP address.

The location of the server remained a mystery for a year, until August 2026, when we were able to discover the group’s new Tornado second-stage active C2 server. This was not an easy task. The threat actor had shifted to a new hosting company, changed strategy from using VPS to a shared website, and even changed its management panel to cPanel. Still, these actions weren’t enough to prevent the group’s discovery.

What surprised us was the threat actor’s decision to host the new C2 server on US soil for the first time in a decade, and at the same time as the beginning of Iran’s most recent conflict with the United States (Figure 11). it is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor.

The geo IP address (68.65.122.203) location of the C2 server
Figure 11. The geo IP address (68.65.122.203) location of the C2 server

The server is managed by cPanel instead of Cyber Panel (Figure 12).

Figure 12. cPanel used for C2 server management
Figure 12. Active cPanel used for C2 server management

The new C2 server IP address (68.65.122.203) was probably first built on July 7, 2026. The first known domain name is kxzsfydnivzmv.privatedns.org (Figure 13).

Log of victim exfiltration’s by Tornado second-stage malware from July 2026, including masked IP, RSA key, victim’s machine GUID, C2 domain name, and time of exfiltration
Figure 13. Log of victim exfiltration’s by Tornado second-stage malware from July 2026, including masked IP, RSA key, victim’s machine GUID, C2 domain name, and time of exfiltration

We also logged Prince of Persia’s testing of data exfiltration (Figure 14). The group has since deleted these logs, which are no longer publicly available.

Exfiltration logs of Tornado second-stage malware from the adversary testing machine
Figure 14. Exfiltration logs of Tornado second-stage malware from the adversary testing machine

The same C2 structure as was documented in September 2025, but the /t/tga.adr is not available to download. We suspect that the threat actor modifed the file name to make it more difficult for security researchers to hunt its Telegram chatbot.

This C2 server is also hosted for the first time not as a VPS or dedicated domain, but instead as a shared hosting infrastructure provided by Namecheap, which hosts thousands of independent domains. Some of these domains are used by various threat actors, mostly for Roblox Typo squatting attacks. This attack’s technique refers to supply-chain attacks where cybercriminals publish malicious packages on open-source software registries (e.g., NPM, PyPI) with names closely mimicking legitimate Roblox development tools (Figure 15).

VirusTotal.com communicating malware binaries to different C2 servers hosted on the same IP but unrelated to Prince of Persia
Figure 15. VirusTotal.com communicating malware binaries to different C2 servers hosted on the same IP but unrelated to Prince of Persia

On August 24, 2026, Prince of Persia started to build a new C2 server behind Cloudflare’s infrastructure (Figure 16). We suspect that the threat actor probably realized that its newest C2 server had been discovered.

Last known Tornado C2 server, hosted on Cloudflare IP
Figure 16. Last known Tornado C2 server, hosted on Cloudflare IP

Prince of Persia indicators of compromise

This blog documents the latest action taken by Prince of Persia. We believe that by publicly sharing this analysis and our observed indicators of compromise (IOCs), we can reduce the impact of this cyber threat.


Tornado second-stage C2 server: 68.65.122.203

  • Active since: July 2026
  • ASN: AS 22612
  • Hosting: Namecheap, Inc.
  • Domain names:
    • jqkctsldgwkbw.privatedns.org
    • emcwoyqtplckl.privatedns.org
    • izwljrmohqwcq.privatedns.org
    • bymznpviesmqs.privatedns.org
    • kxzsfydnivzmv.privatedns.org

Tornado second-stage C2 server: 162.159.24.80

  • Active since: August 24, 2026
  • ASN: AS 13335
  • Hosting: Cloudflare, Inc.
  • Domain name: olbkdmwhacbfc.privatedns.org

Tornado first-stage, Tonnerre, and Foudre C2 server: 185.244.129.123

  • Active since: September 1, 2026
  • Hosting: HOSTGW SRL
  • Domains name for Tornado first stage:
    • ouqqdplfgurg.hbmc.net
    • trllpgwnarxa.hbmc.net
    • dxwwaaciuxyu.hbmc.net
    • hyccrukeryvr.hbmc.net
    • Ipsskhmcdpgd.hbmc.net
    • Izniiyloqqwcq.hbmc.net
    • Twogtmbpkkfnk.hbmc.net
  • Tonnerre and Foudre domain names:
    • mksrnosw.privatedns.org
    • qroosoqs.space
    • ppnrvsst.space
    • noornppw.space
    • qmmnssws.privatedns.org

Tornado first-stage, Tonnerre, and Foudre C2 server: 185.244.129.70

  • Active since: May 2026 – August 2026
  • ASN: AS 204641
  • Hosting: HOSTGW SRL
  • Domain names for Tornado first stage:
    • nnahinsmqs.site
    • nhvvnosqthpt.hbmc.net
    • fdyybjvmodho.hbmc.net
    • btxxceyzjtdj.hbmc.net
    • weaamfurnejn.hbmc.net
    • weaanzurnejn.hbmc.net
    • skttmrdtwkbw.hbmc.net
    • xleergjemlwm.hbmc.net
  • Domain names for Tonnerre version 17:
    • f21.ddnsking.com (non-DGA domain name)
    • c0596f41.site
    • oqunspyr.privatedns.org
    • ktomtvus.privatedns.org
    • jknnsuqt.privatedns.org
    • mntrotxy.privatedns.org
    • lkuqpsrz.privatedns.org
    • kkuqstqx.privatedns.org
    • jntrpsuw.privatedns.org
    • romtqwsz.privatedns.org
    • mmlnotus.privatedns.org
    • lpmmvsqt.privatedns.org
    • joupqrsu.privatedns.org
    • krtsrqyv.privatedns.org
    • osntuouy.privatedns.org
    • onrvrsux.privatedns.org
  • Domain names for Foudre version 34 and later:
    • t21.ddnsking.com (non-DGA domain name)
    • roounvuq.space
    • kmrpopwt.space
    • otorqvvs.space
    • plrmpptr.space
    • qmlmwwyy.space
    • jllpnwpu.space
    • slmootyv.space
    • nnotrtsu.space
    • qooqosxu.space
    • jnovvsqs.space
    • snmpopqr.space
    • nsqowtwu.space
  • Domain names for Tonnerre version 12 and earlier and Foudre version 33 and earlier:
    • aa58862c.ddns.net
    • df1908e3.ddns.net
    • 417d9d40.ddns.net
    • 367aadd6.ddns.net
    • af73fc6c.ddns.net
    • d874ccfa.ddns.net
    • d9b6a6cd.ddns.net
    • 4909bb5c.ddns.net
    • 3e0e8bca.ddns.net
    • 5ec9022f.ddns.net
    • 29ce32b9.ddns.net
    • bb9b243e.ddns.net
    • cc9c14a8.ddns.net
    • 52f8810b.ddns.net
    • 6b4fcd6e.ddns.net
    • f52b58cd.ddns.net
    • 822c685b.ddns.net
    • 10797edc.ddns.net
    • 677e4e4a.ddns.net
    • 07b9c7af.ddns.net
    • 70bef739.ddns.net
    • e38da2e2.ddns.net
    • e001eaa8.ddns.net
    • 5e851c0b.ddns.net
    • 96c4b009.ddns.net
    • 0fcde1b3.ddns.net
    • 78cad125.ddns.net
    • e6ae4486.ddns.net
    • 93efca49.ddns.net
    • 862e1471.privatedns.org
    • ad0347b2.privatedns.org

Take steps now to protect your environment

By sharing our research publicly, we hope to help the community better understand the associated risks and IOCs of this group. Towards this end, we recommend that organizations take the following steps to protect themselves against the techniques used by the Prince of Persia:

  • Ensure that your security controls are updated to protect against the IOCs provided in this post.
  • Monitor for any unusual Telegram traffic.
  • Ensure that your operating systems are fully updated.

References