Unit 42 researchers identified six new remote access Trojan variants used by the Iran-nexus APT group Screening Serpens during early 2026, coinciding with a regional conflict. The group targeted primarily technology sector professionals in the U.S., Israel, UAE, and other Middle Eastern locations using personalized social engineering recruitment lures. Two novel malware families, MiniUpdate and MiniJunk V2, were discovered, featuring advanced techniques including AppDomainManager hijacking that manipulates .NET application initialization to disable security controls. The malware employs DLL sideloading and scheduled tasks for persistence and uses dedicated C2 infrastructure hosted on Microsoft Azure. The campaigns show enhanced technical capabilities and operational resilience to maintain long-term espionage access.

The identified malware variants enable persistent remote access for espionage purposes, targeting high-value individuals in multiple countries. The advanced evasion and persistence techniques, including AppDomainManager hijacking and DLL sideloading, allow the malware to disable security mechanisms and maintain stealthy long-term presence. The use of dedicated C2 infrastructure on Azure supports resilient command and control operations. While no known exploits in the wild are reported, the medium severity reflects the potential impact on targeted organizations' confidentiality and operational security.

No official patches or vendor advisories are available for these malware variants. Organizations should focus on detecting and blocking indicators of compromise such as the identified domains and file hashes. Given the use of social engineering with personalized lures, user awareness training tailored to these tactics is recommended. Monitoring for suspicious scheduled tasks, DLL sideloading behaviors, and anomalous .NET application initialization may help detect infections. Since the C2 infrastructure is hosted on Azure, network monitoring for unusual outbound connections to known malicious domains is advised. Patch status is not yet confirmed — check the referenced vendor advisory from Unit 42 for updates.