Researchers uncovered an espionage campaign orchestrated by the Iran-nexus advanced persistent threat group known as Screening Serpens.
Operating under aliases like UNC1549, the threat actors deployed six remote access trojan variants against organizations in the United States, Israel, and the United Arab Emirates.
These attacks coincided with regional conflicts in the Middle East. They demonstrated significant improvement in the group’s technical capabilities.
Unit 42, in a report shared with Cyber Security News, said the attacks rely heavily on tailored social engineering tactics and advanced evasion methods.
The newly discovered malware families, categorized as MiniUpdate and its evolved version, MiniJunk V2, give attackers extensive control over compromised environments.
The infection vector relies on personalized spear-phishing lures directed at professionals in the technology, aerospace, and defense sectors.
The attackers craft convincing decoy documents, including falsified job requisitions impersonating global air carriers and fake software installation prompts for video conferencing platforms.
Rather than breaching these brands’ infrastructure, the threat actors clone their visual assets to trick targets into downloading malicious archive files.
Once a victim extracts and runs the seemingly legitimate executable, the hidden payloads are silently staged in the background.
At the same time, a spoofed error message is displayed to reduce suspicion. This approach allows the attackers to establish a foothold without triggering an immediate alarm from the user.
MiniUpdate RAT Abuses Azure
The most critical technical evolution in these recent campaigns is the adoption of a defense evasion technique known as AppDomainManager hijacking.
This method manipulates the initialization phase of Microsoft .NET applications by supplying a malicious configuration file alongside a legitimate, signed executable.
Instead of relying on complex shellcode to unhook security monitors in memory, the attackers instruct the runtime environment to proactively turn off its own security mechanisms natively.
The manipulated configuration file forces the application to load a local payload while simultaneously silencing Event Tracing for Windows, which is the primary telemetry source used by endpoint detection and response solutions.
Furthermore, the configuration explicitly bypasses signature validation. It prevents safe redirections, ensuring the malicious code executes in a highly privileged context.
| Malware Family | Delivery Method | Execution Technique | Command and Control Disguise |
|---|---|---|---|
| MiniUpdate | Fake job portals and installers | AppDomainManager hijacking | Azure domains mimicking health entities |
| MiniJunk V2 | Spoofed recruitment ONLYOFFICE portals | DLL sideloading via licensing | Azure domains mimicking Windows services |
According to Paloalto Networks research, to maintain operational resilience and avoid cross-contamination between targets, Screening Serpens routes its command-and-control traffic through dedicated domains hosted primarily on Microsoft Azure.
These domains are specifically registered to impersonate legitimate entities in the health, financial, and technology sectors.
The command dispatcher embedded within the MiniUpdate remote access trojan supports operational codes that facilitate shell command execution, process manipulation, and dynamic code loading.
Recent upgrades to the malware also enable attackers to exfiltrate large files in smaller, stealthier chunks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=Researchers uncovered an espionage campaign orchestrated by the Iran-nexus advanced persistent threat group known as Screening Serpens.){kind=link}