WORLD WATCH · October 23, 2026 · NEWS
Iran's Prince of Persia APT Hosts C&C Server in US After 2016 Gap
Iran-linked Prince of Persia APT has resumed hosting command and control infrastructure in the United States after an eight-year absence.
- Reported by
- SecurityWeek
- Outlets reporting
- 1
- Category
- NEWS
- Newest report
- October 23, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Prince of Persia APT resumed US-based C2 hosting after an eight-year gap.
- The group used a Tornado C2 server on US shared hosting.
- Activity follows a three-month operational lull.
- Iran-linked group previously hosted C2 outside the US since 2016.
What happened
The report comes from SecurityWeek. Prince of Persia hid a Tornado C&C server on US-based shared hosting. This marks the group's first US-hosted C2 server since 2016. The deployment follows a three-month operational lull.
Why it matters
Hosting C2 in the US may reduce network latency and evade detection. Shared hosting can obscure malicious traffic among legitimate services. The return signals renewed operational interest from the group.
What to do
Monitor outbound connections to known Tornado C2 indicators. Block or flag traffic to suspicious US-based shared hosting providers. Review network logs for signs of Prince of Persia tooling or patterns.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 23, 2026). This brief summarizes reporting by SecurityWeek. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.