Executive Summary
Unit 42 has identified a persistent cyberespionage campaign by the Iran-nexus group Screening Serpens (also known as UNC1549 or Smoke Sandstorm). Between February and April 2026, the group intensified its operations, deploying six new remote access Trojan (RAT) variants across two malware families: MiniUpdate and MiniJunk V2. The timing of these attacks correlates with regional conflicts in the Middle East, primarily targeting technology, aerospace, and defense manufacturing sectors.
Technically, the actor has evolved its tradecraft by fusing standard DLL sideloading with advanced AppDomainManager hijacking. This technique manipulates .NET application configuration files to proactively disable security telemetry, such as Event Tracing for Windows (ETW), and skip signature validation before the application initializes. This allows the group to execute code in a highly privileged, unmonitored context.
The group continues to rely on sophisticated social engineering, using tailored recruitment lures and spoofed video conferencing invitations. The consistent use of Azure-hosted infrastructure and unique C2 domains for individual targets demonstrates high operational security and resilience, making this a significant threat to global organizations in targeted high-value sectors.