Screening Serpens, an Iranian advanced persistent threat group, is actively conducting espionage campaigns in 2026 against technology and defense sector targets. Their techniques include hijacking the .NET AppDomainManager to maintain persistence and deploying new variants of remote access trojans to facilitate unauthorized access and data theft. The detailed analysis by Unit 42 provides insight into their evolving toolset and operational methods. There is no indication of specific vulnerable software versions or publicly available patches. The campaigns represent a targeted espionage threat rather than a widespread vulnerability or exploit.

The impact involves unauthorized access and espionage targeting sensitive sectors such as technology and defense. The use of AppDomainManager hijacking and new RAT variants allows the threat actor to maintain persistence and potentially exfiltrate confidential information. There are no reports of widespread exploitation or direct damage beyond espionage activities. The medium severity rating reflects the targeted nature and potential sensitivity of compromised data.

No specific patches or fixes are identified for this threat. Organizations in the technology and defense sectors should monitor for indicators of compromise related to AppDomainManager hijacking and RAT activity as detailed by Unit 42. Implementing detection and response capabilities focused on these tactics is recommended. Since no vendor advisory or official patch is available, standard threat hunting and incident response procedures aligned with the threat actor's known behaviors should be employed.