Adversary Intelligence — 2026-06-02

Iran-Linked Screening Serpens Deploys Six New RAT Variants Against US Israel and UAE Organizations During Regional Conflict

BLUFSix new RAT variants in ten weeks from Screening Serpens indicates an operational tempo increase that will outpace static defense cycles at most targeted organizations.

Unit 42 researchers identified six new RAT variants deployed by Screening Serpens (UNC1549) between mid-February and April 2026, targeting US, Israeli, and UAE organizations in coordinated waves during late March and mid-April, with two additional Middle Eastern entities assessed as likely also targeted 12. Both malware families, MiniUpdate (also tracked as MiniFast, assessed by Unit 42 as likely AI-assisted in development) and MiniJunk V2, are delivered through spear-phishing lures impersonating job portals and video conferencing installers 12. The campaigns employ AppDomainManager hijacking, which abuses legitimate .NET configuration files to disable Event Tracing for Windows and bypass strong-name signature validation before EDR platforms can monitor execution 2. Command-and-control traffic routes through three to five Azure-hosted domains per target and variant; April campaign variants expanded the MiniUpdate command dispatcher from 16 to 18 opcodes, with at least one sample embedding timing instructions at compile time 1.

Analysis
AppDomainManager hijacking operates at CLR initialization before EDR platforms can monitor execution, leaving organizations without tuned detection for abnormal .NET configuration files blind from first contact. Geographic sequencing tracks the February 28 conflict onset: US and Israeli organizations in late March, UAE targets in mid-April. Per-target Azure domain rotation defeats static blocklists and pushes defenders toward behavioral detection of DLL sideloading and abnormal child processes from trusted installers. Six variants across two families in roughly ten weeks signals an accelerating development cycle. Low analytic confidence: both outlets are secondary rewrites of a single undisclosed Unit 42 report with no independent access to infrastructure or samples. The per-target domain compartmentalization and compile-time scheduling instructions fit a contractor-operated infrastructure model, making attribution to a single organized state actor harder to sustain.

3 sources

Threat Actors Linked to Iran Leverage AppDomainManager to Evade Detection - Cyber Security News
Iranian Hackers Abuse AppDomainManager Hijacking to Evade EDR Detection - Cybersecurity News
Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns - Unit 42 (Palo Alto Networks)