# Prince of Persia Hosts US C2 Server

Semperis reports that the Iran-linked Prince of Persia (Infy) threat group resumed data theft in 2026 after a confirmed three-month pause and hosted a command-and-control server in the United States for the first time since 2016. The report identifies no solicitation or contract opportunity, but the use of US-based infrastructure has practical implications for government and contractor security operations relying on commercial cloud and web-hosting services.

- Government and contractor security teams can review Semperis’s published indicators of compromise and assess them against their environments.
- Security teams should account for suspicious Telegram traffic and command infrastructure hosted on shared commercial services when investigating potential activity.
- Contractors providing cybersecurity, cloud, or hosting services may find the report relevant to threat detection and incident-response planning for customers handling government data.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 23, 2026

### Government Entities
- Iranian government
- United States government

### Key Quotes
> It is not unusual for nation-state–sponsored threat groups to hide C2 servers inside the United States using cloud infrastructure and web hosting providers, but it is unusual behavior for this threat actor.
> — Tomer Bar, AVP of security research at Semperis

### Sources
- [Iran's Prince of Persia APT Hosts C&C in US for First Time Since 2016 - SecurityWeek](https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016) - SecurityWeek