Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns
Summary: Unit 42 observed Iran-nexus APT Screening Serpens (aka UNC1549, Smoke Sandstorm, Iranian Dream Job) targeting entities in the U.S., Israel and the UAE, plus likely two more Middle Eastern entities, in campaigns running mid-February through April 2026 that aligned with the regional conflict starting Feb. 28, 2026. Researchers found six new RAT variants across two malware families, delivered through recruitment and brand-impersonation lures and using AppDomainManager hijacking to disable .NET application security before the host application starts.
What's compelling: The group rotated command-and-control domains per target and variant - three to five unique Azure-hosted domains each - to prevent cross-contamination, and its April variants added an 18-opcode dispatcher that chunks file exfiltration; that per-target infrastructure discipline is what makes this campaign hard to cluster and contain.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026