---
title: Hunt: Iran's Prince of Persia (Infy) put a Tornado C2 on US shared hosting (68.65.122.203, Namecheap), then moved behind Cloudflare; DGA domains on privatedns.org, hbmc.net and .space | ctxsec
url: https://ctxsec.com/items/hunt-semperis-prince-of-persia-us-c2
description: ""
status: "confirmed research (Semperis, Oct 22; activity May to Sep 2026)"
published: 2026-10-23
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-semperis-prince-of-persia-us-c2.md)

confirmed research (Semperis, Oct 22; activity May to Sep 2026)

2026-10-23

### Hunt: Iran's Prince of Persia (Infy) put a Tornado C2 on US shared hosting (68.65.122.203, Namecheap), then moved behind Cloudflare; DGA domains on privatedns.org, hbmc.net and .space

Semperis says the Iranian state-sponsored group Prince of Persia (also called Infy; Foudre, Tonnerre and Tornado malware) went quiet after SafeBreach's February research and the Feb 28 start of the US-Israel conflict with Iran. It resumed on **May 27** and in **July** stood up its first US-hosted C2 since 2016. Victims are mostly Iranian dissidents and are few, but one exfiltrated 1,800+ files in a week.

- **Tornado stage-2 C2:** `68.65.122[.]203` (AS22612 Namecheap shared hosting, cPanel, from ~Jul 7). Domains `kxzsfydnivzmv`, `jqkctsldgwkbw`, `emcwoyqtplckl`, `izwljrmohqwcq`, `bymznpviesmqs` `.privatedns[.]org`. From **Aug 24**: `olbkdmwhacbfc.privatedns[.]org` on Cloudflare `162.159.24[.]80`.
- **Stage-1 / Foudre / Tonnerre C2:** `185.244.129[.]70` (May to Aug) and `185.244.129[.]123` (from Sep 1), HOSTGW SRL, CyberPanel on **TCP 8090**. Watch for 12-letter random labels under `hbmc[.]net`, 8-letter `.space` and `.privatedns[.]org` names, and `f21`/`t21.ddnsking[.]com`.
- **Older ranges to retro-hunt:** `45.80.148.0/24`, `45.80.149.0/24`, `45.80.151.0/24` and hex-named `*.ddns[.]net` hosts (e.g. `aa58862c.ddns[.]net`).
- **Behavior:** exfil over HTTPS POSTs (e.g. `fdir.php`) plus the **Telegram Bot API**. Flag `api.telegram.org` traffic from hosts with no business need. Tornado has been dropped through one-day bugs such as WinRAR exploits.

Since the actor uses shared hosting and Cloudflare, block the domains and treat the shared IPs as hunting leads, not blocklist entries.

Sources: [Semperis: Prince of Persia, a threat group hiding in plain sight (Oct 22, full IOC list)](https://www.semperis.com/blog/prince-of-persia-threat-group-hiding-in-plain-sight/) · [Semperis press release (Oct 22)](https://www.semperis.com/press-release/semperis-researcher-discovers-an-iranian-nation-state-sponsored-threat-group-operating-command-and-control-infrastructure-in-the-united-states/) · [SecurityWeek: Iran's Prince of Persia APT hosts C&C in US for first time since 2016 (Oct 23)](https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016/)