Semperis says the Iranian state-sponsored group Prince of Persia (also called Infy; Foudre, Tonnerre and Tornado malware) went quiet after SafeBreach's February research and the Feb 28 start of the US-Israel conflict with Iran. It resumed on May 27 and in July stood up its first US-hosted C2 since 2016. Victims are mostly Iranian dissidents and are few, but one exfiltrated 1,800+ files in a week.

• Tornado stage-2 C2: 68.65.122[.]203 (AS22612 Namecheap shared hosting, cPanel, from ~Jul 7). Domains kxzsfydnivzmv, jqkctsldgwkbw, emcwoyqtplckl, izwljrmohqwcq, bymznpviesmqs .privatedns[.]org. From Aug 24: olbkdmwhacbfc.privatedns[.]org on Cloudflare 162.159.24[.]80.
• Stage-1 / Foudre / Tonnerre C2: 185.244.129[.]70 (May to Aug) and 185.244.129[.]123 (from Sep 1), HOSTGW SRL, CyberPanel on TCP 8090. Watch for 12-letter random labels under hbmc[.]net, 8-letter .space and .privatedns[.]org names, and f21/t21.ddnsking[.]com.
• Older ranges to retro-hunt: 45.80.148.0/24, 45.80.149.0/24, 45.80.151.0/24 and hex-named *.ddns[.]net hosts (e.g. aa58862c.ddns[.]net).
• Behavior: exfil over HTTPS POSTs (e.g. fdir.php) plus the Telegram Bot API. Flag api.telegram.org traffic from hosts with no business need. Tornado has been dropped through one-day bugs such as WinRAR exploits.

Since the actor uses shared hosting and Cloudflare, block the domains and treat the shared IPs as hunting leads, not blocklist entries.