Cybersecurity researchers at Semperis have uncovered that the Iranian hacking group known as Prince of Persia has been using command-and-control servers located in the United States to conduct its cyber-espionage activities. This group has been active for nearly two decades and targets a range of organizations across the US, Europe, and the Middle East, including those opposed to the Iranian regime. The group's malware arsenal, which includes Foudre and Tonnerre, allows for extensive data exfiltration, such as stealing sensitive documents, capturing screenshots, and recording audio. The latest addition to their toolkit is Tornado, a malware capable of using both HTTPS and the Telegram API as covert communication channels, making it difficult to detect. Historically, Prince of Persia has hidden its activities on European hosting services, but the discovery of Tornado's deployment on US servers marks a significant shift in their operational strategy. This is the first time in over a decade that an Iranian threat group has been found using US-based infrastructure. Despite being highly targeted, Prince of Persia remains a persistent threat, and organizations are advised to take precautions against their sophisticated attacks.