- Semperis says Iranian group Prince of Persia placed a Tornado malware control server on US shared hosting in 2026, the first US placement in a decade.
- The server sat among thousands of unrelated domains, so a server's location says little about who runs it.
- Semperis advises teams to load its indicators, watch for unusual Telegram traffic and keep operating systems updated.
Where a server sits says little about who runs it. A new Semperis report traces an Iranian hacking group called Prince of Persia to a server inside the United States, and the finding shows why.
What Semperis found
Semperis says the group has operated for nearly two decades. Its victims include Iranian dissidents and organisations, both public and private, across the US, Europe and the Middle East.
A command-and-control (C2) server is the machine that sends orders to infected computers and receives the stolen data. After research by SafeBreach was published on February 4, 2026, Semperis says the group shut down one C2 server in under a week. It then opened another on February 9. Its last domain registration was on February 25.
Since March, Semperis says, the group has had no publicly identified activity. Semperis kept watching anyway. It reports a three-month silence, the longest in the group's history, ending on May 27 with a new C2 server. In the first week, the group's Tonnerre spyware took more than 1,800 files from one victim. Semperis masked the victim's details.
In August 2026 the researchers found the missing piece, a C2 server for the second stage of the Tornado malware. It sits at 68.65.122.203 and was probably built on July 7. Semperis calls it the first time in a decade the group has used US soil.
The disguise is the hosting, not the country
The server is not a rented virtual machine of its own. Semperis says it is shared hosting from Namecheap, which serves thousands of independent domains. Some of those domains are used by other threat actors, mostly for Roblox typosquatting. The group also switched its management panel from Cyber Panel to cPanel.
Semperis notes that nation-state groups often hide C2 servers in the US. It calls the move unusual only for this group.
This shows why geography is a weak filter. A rule that flags only Iranian or non-US addresses would have no reason to fire on this server. The group changed what the server looked like, not just where it was.
How the malware stays hidden
Semperis says Tornado arrives through known software flaws, such as WinRAR exploits. It then talks to its operators over ordinary HTTPS and the Telegram messaging API. That blends with legitimate traffic and helps it pass firewalls.
Several design choices make the infrastructure hard to map. The malware uses a domain generation algorithm (DGA), a formula that produces new domain names on a schedule. One such domain, nnahinsmqs.site, was registered in the week of May 31. Blocking a fixed list of names does not keep up with a formula.
Tornado can also read hidden fields in blockchain transactions. Semperis says this lets the operators change C2 routing without sending infected machines a code update. The C2 also checks RSA signatures, a cryptographic proof, on incoming requests. Semperis says this locks out researchers and automated scanners.
The Telegram key is not stored in the malware. Semperis says a file named tga.adr on the second-stage server delivers it to chosen victims. That file is no longer downloadable, and Semperis suspects it was renamed to frustrate hunters. On August 24 the group began building a new server behind Cloudflare. Semperis suspects the group realised its newest server had been found.
What the sources leave open
Semperis says the number of victims it has seen is low. That could mean targeted attacks or trouble infecting new victims. Infosecurity Magazine describes the activity as highly targeted rather than widespread.
Semperis also says it could not prove where the second-stage server ran between September 2025 and August 2026. It links the group's activity to the US-Iran conflict, but does not state why the group chose US hosting. The reports include no comment from Namecheap. Infosecurity Magazine puts the gap in US hosting at at least 12 years, while Semperis says a decade.
Questions for your security team
Semperis recommends three steps: update security controls with its published indicators, monitor for unusual Telegram traffic, and keep operating systems fully updated. The indicators include the IP addresses 68.65.122.203, 162.159.24.80, 185.244.129.123 and 185.244.129.70.
Leaders can ask four things. Does our monitoring show which office machines talk to the Telegram API, and does anyone review it? Have we loaded the Semperis indicators? How much weight do our detection rules give to a server's country? How quickly do we patch widely used tools such as WinRAR?
A map shows where a server sits. It does not show who rented it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Semperis.
