Prince of Persia Resumes Data Theft, Uses U.S.-Hosted Command Server

Semperis reports that Prince of Persia, also known as Infy, resumed data theft in 2026 following a confirmed three-month pause in activity. The Iran-linked threat group also hosted a command-and-control (C2) server in the United States for the first time since 2016. That change in infrastructure is notable for defenders: activity associated with a foreign-linked threat actor may use domestic commercial hosting, making geographic location alone an unreliable basis for assessing whether network activity is benign or suspicious.

For the United States government and its contractors, the report is relevant to cybersecurity operations rather than a new procurement action. It identifies no solicitation, contract award, or funding announcement. Instead, the findings can inform threat hunting, incident-response procedures, and security monitoring for organizations that handle government data or provide cloud, web-hosting, and cybersecurity services. Shared commercial infrastructure can complicate attribution and detection, so defenders may need to combine indicators of compromise (IOCs) with behavioral analysis and context from their own environments.

Semperis’s Tomer Bar, AVP of security research, described the U.S.-based infrastructure as unusual for this actor, while noting that the broader practice is established among nation-state-sponsored groups: “It is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor.” The distinction matters for operational planning. A U.S. hosting location does not by itself establish that a server or connection is legitimate, and defenders should avoid treating domestic hosting as a sufficient trust signal.

The report also points security teams toward practical steps that can be taken without waiting for a new government directive or procurement cycle. Organizations can review Semperis’s published IOCs against network, endpoint, and cloud telemetry; examine suspicious Telegram traffic in context; and consider how their monitoring detects command infrastructure on shared commercial services. Contractors supporting government customers may use the findings to test detection coverage, update incident-response playbooks, and coordinate escalation procedures with customers. Any operational changes should be grounded in validated indicators and the organization’s own threat-intelligence and risk-management processes.

• Semperis reports that Prince of Persia (Infy) resumed data theft in 2026 after a confirmed three-month pause.
• The group hosted a C2 server in the United States for the first time since 2016, according to the report.
• The reported activity is associated with an Iran-linked threat group; the report does not identify a government procurement or contract action.
• Government and contractor security teams can review Semperis’s published indicators of compromise against their environments.
• Investigations should account for suspicious Telegram traffic and command infrastructure hosted on shared commercial services.
• Domestic hosting location alone should not be treated as proof that network infrastructure is trustworthy or benign.
• Cybersecurity, cloud, and hosting contractors can assess detection and incident-response coverage for customers handling government data.
• Tomer Bar of Semperis characterized U.S.-hosted C2 as unusual behavior for this particular threat actor, despite its use by other nation-state-sponsored groups.