Prince of Persia Threat Group Returns to US Servers
The Iranian-sponsored group has resumed operations using US-based infrastructure following a three-month operational lull.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you trust that major web hosting providers take sufficient action against cyberattacks in your area?
The Prince of Persia threat group, active for nearly two decades, restarted operations on May 27, 2026, and established a command-and-control server in the United States by July 7. The group utilizes shared hosting providers to conduct surveillance and data theft against dissidents.
Why it matters
The group's shift from virtual private servers to shared hosting providers complicates detection and attribution efforts for international security entities. Their continued targeting of dissidents across the US, Europe, and the Middle East highlights the persistent cyber espionage threat posed by state-sponsored actors.
The group deployed the Tonnerre malware family, which successfully siphoned over 1,800 files from a single victim in one week. In August 2026, they began routing second-stage operations for the Tornado malware family through Cloudflare infrastructure.
The players
Prince of Persia
This is an Iranian government-sponsored threat group that has conducted cyber espionage operations for nearly 20 years.
SafeBreach
This cybersecurity firm published the February 2026 report that preceded a temporary cessation in the group's operations.
The details
After a three-month hiatus following a February 2026 report, the group adapted its tactics by moving away from virtual private servers toward Namecheap shared hosting. This infrastructure strategy allows the actors to better disguise command-and-control servers behind legitimate cloud and web hosting services.
Timeline
February 2026: SafeBreach published a report on the threat group.
February 28, 2026: Conflict escalated between Iran, the US, and Israel.
May 27, 2026: Prince of Persia resumed operations.
July 7, 2026: The group established a new command-and-control server in the United States.
August 24, 2026: The group began configuring a second-stage server using Cloudflare.
The Tech Race
The Prince of Persia group's shift toward shared hosting providers and cloud-based obfuscation reflects a broader move away from traditional, easily identifiable virtual private servers. This evolving infrastructure strategy forces security firms to constantly update detection heuristics to combat state-sponsored actors.
Users and entities in targeted regions may face heightened risks of data exfiltration and surveillance as the group improves its server-cloaking tactics. Organizations should monitor for unauthorized file access and audit traffic patterns associated with common shared hosting providers.
The takeaway
Maintaining robust network monitoring is essential as threat actors increasingly hide malicious command-and-control traffic behind legitimate cloud infrastructure. Security teams should prioritize hardening endpoints against specialized malware families like Tonnerre that excel at rapid data theft.
Further reading
For more on the latest threats to digital infrastructure, visit our Cybersecurity section.
Source note: This article includes information reported by SecurityWeek.
Live Poll
Do you trust that major web hosting providers take sufficient action against cyberattacks in your area?
