← threat actors
threat actor · IR
Infy
also tracked as prince of persia 2
2 stories · 2 in the wild · September 6, 2026 – October 26, 2026
evidence: 2 observed
sectors
- critical infrastructure 1 · Oct 26
malware and tools
- tonnerre 1 · Oct 26
- tornado 1 · Oct 26
techniques
- collection 1 · Oct 26
- impact 1 · Oct 26
attack phases seen
- Collection 1 · Oct 26
- Impact 1 · Oct 26
what we reported, newest first, grouped by story
October 26, 2026
- Iran’s Prince of Persia placed Tornado C2 infrastructure on US shared hosting for the first time since 2016. The state-sponsored actor, also tracked as Infy, resumed operations on May 27 after a three-month pause. Its Tonnerre malware then removed more than 1,800 files from one victim within seven days. In August, researchers found a second-stage server for the actor’s Tornado malware on Namecheap shared hosting; later infrastructure moved behind Cloudflare (SecurityWeek).
· Oct 26 · observed · as prince of persia · Threat Activity
September 6, 2026
- Prince of Persia appears to have reserve infrastructure staged for continued activity. Whisper Security mapped the campaign’s backend and spare domains and published IOCs that can support proactive hunting and blocking. Whisper Security
· Sep 6 · observed · as prince of persia · Threat Activity