Iranian Hackers Resume Operations Using US Servers
The Prince of Persia group is using shared hosting and cloud providers to obfuscate malicious traffic globally.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you trust that major web hosting providers take sufficient action against cyberattacks in your area?
Iranian-sponsored threat group Prince of Persia resumed operations on May 27, 2026, following a three-month hiatus. The group has now transitioned to using shared hosting providers and US-based infrastructure for its command-and-control servers.
Why it matters
This shift in infrastructure suggests a move to evade detection by blending malicious activity with legitimate web traffic. The group continues to actively target dissidents and entities across the US, Europe, and the Middle East.
The group siphoned 1,800 files from a single victim using the Tonnerre malware family over a seven-day period. Attackers are now deploying secondary servers behind Cloudflare, a shift from their previous reliance on virtual private servers.
The players
Prince of Persia
An Iranian government-sponsored threat group operating for nearly 20 years.
SafeBreach
A cybersecurity firm specializing in breach and attack simulation that published research on the group.
Namecheap
A domain registrar and shared hosting provider currently being utilized by the threat group.
Cloudflare
A web infrastructure and security company whose services are being used to shield C&C servers.
The details
Prince of Persia, an Iranian-state-sponsored group, manages command-and-control (C&C) servers—central systems used to send instructions to compromised devices—to oversee its operations. The group recently pivoted to using shared hosting providers like Namecheap to obfuscate their digital footprint. They utilize the Tonnerre malware family for data exfiltration and the Tornado malware family for secondary stage operations, hiding this infrastructure behind cloud delivery networks.
Timeline
2016: Last previous usage of US-based C&C infrastructure.
February 2026: SafeBreach published a report on the threat group.
May 27, 2026: Prince of Persia resumed operations.
July 7, 2026: Likely creation date of the new US-based server.
August 24, 2026: Group began configuring a new server behind Cloudflare.
The Tech Race
The group's operational pause following the February 2026 SafeBreach report highlights the impact of public attribution on state-sponsored actors. The transition to shared hosting represents a direct attempt to circumvent the scrutiny established by recent security research.
Organizations and individuals in the US, Europe, and the Middle East remain the primary targets of these exfiltration campaigns. Users should monitor for unauthorized file access and audit web traffic patterns associated with shared hosting and cloud infrastructure providers.
The takeaway
The return of Prince of Persia shows that state-sponsored groups prioritize resilience by rapidly adopting common cloud infrastructure to mask their C&C traffic. Security teams should prioritize monitoring traffic patterns associated with shared hosting providers rather than relying on static IP-based blacklists.
Further reading
For more analysis on state-sponsored hacking techniques, see the Cybersecurity section.
Source note: This article includes information reported by SecurityWeek.
Live Poll
Do you trust that major web hosting providers take sufficient action against cyberattacks in your area?
