Overview
- Semperis published its research on Oct. 22 saying its analysts traced a command‑and‑control server to a U.S. hosting provider that was first identified in August 2026.
- Researchers found a layered toolset in the campaign with Foudre as a loader, Tonnerre providing surveillance and Tornado using HTTPS and the Telegram API as covert C2 channels.
- The threat actor shifted to shared hosting and built infrastructure behind Cloudflare, a setup that buries malicious domains among legitimate sites and complicates attribution and removal.
- Semperis posted indicators of compromise and told defenders to add the IOCs to security tools, watch for unusual Telegram traffic and keep operating systems and controls fully patched.
- The group has been tracked for about a decade, targets dissidents and organizations in the U.S., Europe and the Middle East, and briefly paused operations in February 2026 during the Iran‑U.S.-Israel conflict.