Islamic Republic-linked hackers targeted dissidents from a US server

The hacking group "Infy", which is linked to the Islamic Republic and also known as "Prince of Persia", used a command-and-control server on US soil this year to spy on Iranian dissidents. Tomer Bar, a researcher at the cybersecurity firm SafeBreach, says this is the group's first infrastructure in the United States since 2016, and it was identified in the Iranian month of Mordad (July–August).

According to the researcher, the group's main targets are Iranian opponents of the Islamic Republic, and government bodies and private companies in the United States, Europe and the Middle East have also been targeted. Tomer Bar said the United States was the last place they expected to find the group.

Pause and return after the war began

According to SafeBreach's findings, the group halted its activity for about three months after the United States and Israel's war with the Islamic Republic began on 28 February 2026, and returned with new infrastructure on 27 May 2026. This time, instead of dedicated virtual servers, it used shared hosting in the United States to hide among ordinary websites, and then moved part of its infrastructure behind Cloudflare's services. Just one week after its return, one of the group's malware tools extracted more than 1,800 files from a victim's computer.

The server identified in Mordad is linked to a new piece of malware called "Tornado", a new version of the "Tonnerre" malware family that can deliver stolen files to its operators through Telegram channels.

Infy's record

Infy has been active for nearly two decades and is considered one of the oldest cyber-espionage groups linked to the Islamic Republic. Researchers had previously reported that on 8 January 2026, at the same time as the nationwide internet shutdown in Iran during the Dey uprising, the group stopped maintaining its servers and registered new domains two days before the internet was restored. The threat intelligence firm KELA has also reported that, outside Iran, the United States has been the main target of the group's active infrastructure.

Cyber espionage is part of the Islamic Republic's transnational repression, which ranges from threatening and pursuing journalists of the independent Persian-language media to putting pressure on the families of activists abroad.

The Islamic Republic has even used servers on US soil to spy on its opponents.