Prince of Persia APT Relocates Tornado C2 to US Shared Hosting After Three-Month Post-Conflict Pause

Semperis researcher Tomer Bar tracked the group's restart on May 27 with new C2 nodes after SafeBreach's February report triggered immediate server takedowns. Within seven days Tonnerre malware exfiltrated 1,800 files via Telegram bot from one victim; a July 7 Tornado server appeared on Namecheap shared hosting hosting thousands of legitimate domains alongside other threat actors, abandoning prior VPS patterns. The August 24 Cloudflare-hidden follow-on node indicates rapid adaptation once the US server was exposed. This marks a deliberate shift from VPS to high-density shared hosting to blend into US infrastructure.

The three-month silence exceeds any prior confirmed downtime during two decades of monitoring, overlapping exactly with the Iran conflict window rather than visibility gaps. Technical evidence shows infrastructure relocation, provider switch, and new malware staging within 90 days of conflict end, with low victim volume suggesting either highly targeted operations or compromised access recovery. No independent technical attribution beyond researcher telemetry confirms state sponsorship, though targeting of Iranian dissidents and Middle East entities aligns with documented Infy patterns.

The US-hosted C2 increases global detection surface while complicating takedown requests; shared hosting placement raises collateral risks to legitimate sites. Organizations must ingest the shared IoCs and monitor Telegram exfil traffic. Next phase likely involves further provider diversification or return to VPS once exposure risk is reassessed within 60 days.

US hosting for Prince of Persia signals broader APT tactic evolution toward Western cloud density for survivability, forcing defenders to expand monitoring beyond traditional VPS and bulletproof providers.