Iran’s Prince of Persia Spies Move Their C2 Onto US Soil

Prince of Persia, an Iranian state-linked espionage group also known as Infy, has rebuilt its infrastructure after being exposed in February and is now running a command server on US soil, Semperis researcher Tomer Bar reports. Bar says that’s the first US-hosted server he’s seen from the group in a decade. The group, active since roughly 2010, has mostly spied on Iranian dissidents, activists and journalists, along with organizations in the US, Europe and the Middle East.

68.65.122[.]203
162.159.24[.]80
185.244.129[.]123
185.244.129[.]70
jqkctsldgwkbw[.]privatedns[.]org
olbkdmwhacbfc[.]privatedns[.]org
ouqqdplfgurg[.]hbmc[.]net
nnahinsmqs[.]site
f21[.]ddnsking[.]com
t21[.]ddnsking[.]com
qroosoqs[.]space

Source article: Prince of Persia: Threat Group Hiding in Plain Sight
Publisher: Semperis (author: Tomer Bar)
Published: Oct. 22, 2026
URL: https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/

Executive Summary

Semperis tracks Prince of Persia, an Iranian state-linked espionage group active since about 2010 and first publicly reported by Unit 42 in 2016 under the name of its original malware, Infy (Operation Mermaid, aimed at Danish diplomats around 2010, is suspected to be an early iteration). The group spies mainly on Iranian dissidents, activists and journalists, plus organizations in the US, Europe and the Middle East. Its toolset has three current families: Foudre, a first stage that profiles the victim, logs keystrokes, steals browser credentials and decides whether a host is worth more; Tonnerre, a second stage pulled down by Foudre for valuable hosts that records audio, takes screenshots and collects documents, cookies and credentials; and Tornado, a newer parallel first- and second-stage family (first reported by SafeBreach in February 2026) delivered through one-day bugs such as WinRAR flaws. Tornado talks to its C2 over HTTPS and the Telegram Bot API (the bot key and chat ID are fetched from the C2’s configuration, not hardcoded), rotates domains with a date-seeded DGA, can be re-routed through data hidden in blockchain transactions, and checks RSA signatures so sinkholes and scanners cannot impersonate its servers. After public exposure in early February 2026 the operators cleared victim GUIDs from their C2 update list on Feb. 9 and went quiet until May 27, then rebuilt on shared Namecheap and HOSTGW hosting and a Cloudflare-fronted server; the Tornado second-stage server at 68.65.122[.]203 is the first US-hosted C2 Semperis has seen from the group in a decade. One victim lost more than 1,800 files in its first week in May 2026, and Semperis describes victim counts as still low. Semperis publishes C2 IPs and domains but no hashes, rules or host artifacts, so the hunt leads below are network-led; false-positive expectations and the full indicator list are detailed below.

ATT&CK chain: Initial Access → Execution → Credential Access → Collection → Command and Control → Exfiltration

Hunt Lead Grid

Prince of Persia C2 Infrastructure Sweep Since May 2026

Semperis lists four live C2 servers and the domains each one answered for: the Tornado second-stage server 68.65.122[.]203 on Namecheap (AS22612, probably built July 7, 2026 and found in August), the Cloudflare-fronted Tornado second-stage address 162.159.24[.]80 (since Aug. 24, 2026), and two HOSTGW SRL servers carrying Tornado first-stage, Tonnerre and Foudre traffic, 185.244.129[.]70 (active May 27 to August 2026, when exfiltration resumed after the group’s pause) and 185.244.129[.]123 (since Sept. 1, 2026). It also lists older C2 addresses from 2025 and early 2026 in the 45.80.148.0/24, 45.80.149.0/24 and 45.80.151.0/24 ranges, and older Tonnerre (version 12 and below) and Foudre (version 33 and below) domains made of eight hex characters under ddns.net. The detection logic is a retrospective match of every address and domain below against DNS resolver logs, proxy and firewall logs and NetFlow, followed by a review of which hosts made the request and how often, since a beaconing implant will show repeated contact rather than a single lookup.

Run it across DNS, proxy, firewall and EDR network telemetry, sweeping back to at least May 27, 2026 for the current servers and to mid-2025 for the historical 45.80.148.0/24 and 45.80.149.0/24 addresses, because Foudre installs persist and the group has kept victims across server changes. Scope first to laptops of staff who deal with Iran, the Iranian diaspora, human rights or journalism, and to anyone in government or policy roles in the US, Europe or the Middle East. Do not block 162.159.24[.]80 outright: it is a Cloudflare address shared by unrelated sites, so match the olbkdmwhacbfc[.]privatedns[.]org name instead, and treat whole-range blocks of the 45.80.148.0/24 neighbourhood as a judgement call for the same reason. Blocking the domain list in DNS and the dedicated Namecheap and HOSTGW addresses at the perimeter is reasonable. Any host that resolved or contacted these names should be treated as a likely Foudre or Tornado infection and escalated: collect the host, check for unknown executables delivered through archive files, and review what data left it, since Semperis saw more than 1,800 files taken from one victim in a week.

Indicator list from the source article (de-fanged):

# Tornado second-stage C2: 68.65.122[.]203 (AS22612 Namecheap, active since July 2026)
jqkctsldgwkbw[.]privatedns[.]org  emcwoyqtplckl[.]privatedns[.]org  izwljrmohqwcq[.]privatedns[.]org
bymznpviesmqs[.]privatedns[.]org  kxzsfydnivzmv[.]privatedns[.]org
# Tornado second-stage C2: 162.159.24[.]80 (AS13335 Cloudflare front, since Aug. 24, 2026; shared address, match the domain)
olbkdmwhacbfc[.]privatedns[.]org
# Tornado first-stage, Tonnerre and Foudre C2: 185.244.129[.]123 (HOSTGW SRL, since Sept. 1, 2026)
ouqqdplfgurg[.]hbmc[.]net  trllpgwnarxa[.]hbmc[.]net  dxwwaaciuxyu[.]hbmc[.]net  hyccrukeryvr[.]hbmc[.]net
twogtmbpkkfnk[.]hbmc[.]net  (two further hbmc[.]net names for this server are in the Semperis post)
mksrnosw[.]privatedns[.]org  qmmnssws[.]privatedns[.]org  qroosoqs[.]space  ppnrvsst[.]space  noornppw[.]space
# Tornado first-stage, Tonnerre and Foudre C2: 185.244.129[.]70 (HOSTGW SRL, May to August 2026)
# Tornado first-stage
nnahinsmqs[.]site  nhvvnosqthpt[.]hbmc[.]net  fdyybjvmodho[.]hbmc[.]net  btxxceyzjtdj[.]hbmc[.]net
weaamfurnejn[.]hbmc[.]net  weaanzurnejn[.]hbmc[.]net  skttmrdtwkbw[.]hbmc[.]net  xleergjemlwm[.]hbmc[.]net
# Tonnerre v17
f21[.]ddnsking[.]com (non-DGA)  c0596f41[.]site  oqunspyr[.]privatedns[.]org  ktomtvus[.]privatedns[.]org
jknnsuqt[.]privatedns[.]org  mntrotxy[.]privatedns[.]org  lkuqpsrz[.]privatedns[.]org  kkuqstqx[.]privatedns[.]org
jntrpsuw[.]privatedns[.]org  romtqwsz[.]privatedns[.]org  mmlnotus[.]privatedns[.]org  lpmmvsqt[.]privatedns[.]org
joupqrsu[.]privatedns[.]org  krtsrqyv[.]privatedns[.]org  osntuouy[.]privatedns[.]org  onrvrsux[.]privatedns[.]org
# Foudre v34 and later
t21[.]ddnsking[.]com (non-DGA)  roounvuq[.]space  kmrpopwt[.]space  otorqvvs[.]space  plrmpptr[.]space
qmlmwwyy[.]space  jllpnwpu[.]space  slmootyv[.]space  nnotrtsu[.]space  qooqosxu[.]space  jnovvsqs[.]space
snmpopqr[.]space  nsqowtwu[.]space
# Tonnerre v12 and earlier / Foudre v33 and earlier
aa58862c[.]ddns[.]net  df1908e3[.]ddns[.]net  417d9d40[.]ddns[.]net  367aadd6[.]ddns[.]net  af73fc6c[.]ddns[.]net
d874ccfa[.]ddns[.]net  d9b6a6cd[.]ddns[.]net  4909bb5c[.]ddns[.]net  3e0e8bca[.]ddns[.]net  5ec9022f[.]ddns[.]net
29ce32b9[.]ddns[.]net  bb9b243e[.]ddns[.]net  cc9c14a8[.]ddns[.]net  52f8810b[.]ddns[.]net  6b4fcd6e[.]ddns[.]net
f52b58cd[.]ddns[.]net  822c685b[.]ddns[.]net  10797edc[.]ddns[.]net  677e4e4a[.]ddns[.]net  07b9c7af[.]ddns[.]net
70bef739[.]ddns[.]net  e38da2e2[.]ddns[.]net  e001eaa8[.]ddns[.]net  5e851c0b[.]ddns[.]net  96c4b009[.]ddns[.]net
0fcde1b3[.]ddns[.]net  78cad125[.]ddns[.]net  e6ae4486[.]ddns[.]net  93efca49[.]ddns[.]net
862e1471[.]privatedns[.]org  ad0347b2[.]privatedns[.]org
# Historical C2, 2025 to early 2026
45.80.148[.]249  45.80.148[.]194  45.80.148[.]195  45.80.148[.]124  45.80.149[.]3
# Ranges previously used: 45.80.148[.]0/24  45.80.149[.]0/24  45.80.151[.]0/24

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols)

Sources: “Prince of Persia: Threat Group Hiding in Plain Sight”, Semperis, Oct. 22, 2026, https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/ (source article)

Tornado tga.adr and fdir.php Requests in Proxy Logs

Semperis found that only the Tornado second-stage server hosted a file named tga.adr, served under the /t/ path and downloadable only by specific victims; it holds the Telegram bot API key that the implant uses to send stolen data to an operator-controlled group chat. The same infrastructure answered HTTP POST requests to fdir.php with a list of exfiltrated file names and sizes, and exfiltrated files were stored under names built as the letter L followed by a YYMMDDHHMMSS timestamp and the victim IP with octets overwritten by zeros. The detection logic is a URL sweep of proxy, web gateway and TLS-inspection logs for any request whose path ends in /t/tga.adr or tga.adr, and for POSTs to a path ending in fdir.php on a host that is not one of your known internal or business web applications, followed by a check of whether the destination appears in the infrastructure list above.

Use proxy and secure web gateway logs with full URL paths; HTTPS traffic needs TLS inspection, so where that is not available fall back to the domain sweep above. Sweep back to July 2026 for tga.adr, when the second-stage server was built. Semperis notes the file stopped being downloadable from the July 2026 server and that the operators later renamed it to defeat exactly this kind of hunt, so a hit is strong evidence but a clean result does not clear a host; pair this lead with the Telegram lead below. fdir.php is a generic file name, so do not alert on the path alone across all traffic; scope it to destinations first seen in the past 90 days or on the listed hosting providers. Any tga.adr hit means the host was selected for Tornado’s Telegram exfiltration stage and should go straight to incident response with a scope review of what was collected.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); Exfiltration → T1041 (Exfiltration Over C2 Channel)

Sources: “Prince of Persia: Threat Group Hiding in Plain Sight”, Semperis, Oct. 22, 2026, https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/ (source article)

Telegram Bot API Traffic From Non-Messaging Processes

Tornado uses the Telegram Bot API as a C2 and exfiltration channel next to HTTPS, and newer Tonnerre builds fall back to Telegram bots and private channels when their DGA domains fail. The bot key and chat ID are not hardcoded in the implant; they come from the C2’s configuration, so the Telegram traffic itself is the stable signal, not a string in the binary. Semperis’s own recommendation is to watch for unusual Telegram traffic. The detection logic is a process-attributed network rule: alert when a process other than the signed Telegram desktop client or a browser resolves or connects to api.telegram.org, with extra weight when the process image sits in a user-writable directory (AppData, Temp, ProgramData, Downloads) or was recently written by an archive tool.

Use EDR network-connection or DNS-query events that carry the process image path, or Sysmon network and DNS events; proxy logs alone show the destination but not which program called it. Sweep back to May 27, 2026, when the group resumed exfiltration. Scope it to all Windows endpoints, with priority on the at-risk user groups named in the sweep lead, and keep a short allowlist of known chat-ops, monitoring or CI bots by full signed image path and host rather than by process name, since an implant can be named anything. Blocking api.telegram.org at the perimeter is a reasonable control where the business does not use Telegram, but it will break legitimate users where it does, and it does not catch Tonnerre’s DGA path, so keep the detection either way. A hit from an unsigned binary in a user-writable path should be escalated as a probable implant; the rule generalizes to the many other stealers and RATs that use Telegram bots for exfiltration.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1102.002 (Web Service: Bidirectional Communication); Exfiltration → T1567 (Exfiltration Over Web Service)

Sources: “Prince of Persia: Threat Group Hiding in Plain Sight”, Semperis, Oct. 22, 2026, https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/ (source article)

DGA-Style Lookups Under Dynamic DNS and Cheap TLDs

Tornado generates its C2 domains with a date-seeded algorithm; Semperis shows the example nnahinsmqs[.]site generated from the seed prefix 26623G3, built as two-digit year, month, week number, the letter G and the digit 3, which means the domain set changes on a weekly cycle and a static blocklist ages quickly. Across the published list the pattern is consistent: Tornado uses 12- and 13-letter random lowercase labels under hbmc[.]net and privatedns[.]org, Tonnerre and Foudre use 8-letter random lowercase labels under privatedns[.]org and the .space and .site TLDs, and older versions used 8-character hex labels under ddns[.]net and privatedns[.]org, with ddnsking[.]com used for fixed fallback names (f21, t21). The detection logic is a DNS analytic that flags a host making lookups of single random-looking labels (8 to 13 lowercase letters with low vowel ratio, or 8 hex characters) under privatedns.org, hbmc.net, ddns.net or ddnsking.com, or under .space and .site, especially when several distinct such names are queried from the same host within a week or most of them return NXDOMAIN.

This needs resolver or EDR DNS logs with the querying host, plus a 30-day baseline of which hosts normally use dynamic DNS zones, since home-lab, IoT and remote-access tools legitimately use ddns.net and similar providers. Back-test over the window since May 2026 using the known domains in the sweep lead as ground truth, then tune the label-entropy and count thresholds until those known names fire and ordinary dynamic DNS use does not. Do not try to precompute and block future Tornado domains from the seed format alone: Semperis does not publish the full algorithm, and guessed lists will be wrong. Scope the alert to endpoints rather than resolvers and servers that legitimately query on behalf of many clients. A host that matches this pattern and also appears in the Telegram lead is a high-confidence infection and should be escalated; the analytic also catches other malware families that rotate DGA names under free dynamic DNS zones.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1568.002 (Dynamic Resolution: Domain Generation Algorithms)

Sources: “Prince of Persia: Threat Group Hiding in Plain Sight”, Semperis, Oct. 22, 2026, https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/ (source article)

Hash Appendix

Foudre, Tonnerre and Tornado samples

Semperis published no file hashes in this report, and no hashes were pulled in from other sources for this report. Earlier vendor reporting on these families (Unit 42 in 2016, SafeBreach in 2025 and February 2026) carries sample hashes; use those reports directly if file-level matching is needed.

MD5s

(not available)  # no hashes published in the source article

SHA1s

(not available)  # no hashes published in the source article

SHA256s

(not available)  # no hashes published in the source article

References Appendix

• “Prince of Persia: Threat Group Hiding in Plain Sight”, Semperis (Tomer Bar), Oct. 22, 2026, https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/ (source article; actor history, malware families, C2 design, timeline, IP and domain indicators, DGA example, recommendations)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/