October 26, 2026
- Iran’s Prince of Persia placed Tornado C2 infrastructure on US shared hosting for the first time since 2016. The state-sponsored actor, also tracked as Infy, resumed operations on May 27 after a three-month pause. Its Tonnerre malware then removed more than 1,800 files from one victim within seven days. In August, researchers found a second-stage server for the actor’s Tornado malware on Namecheap shared hosting; later infrastructure moved behind Cloudflare (SecurityWeek). · Threat Activity