Unit 42 Details Screening Serpens’ MiniUpdate and MiniJunk V2 Espionage Campaigns
Summary
Unit 42 attributes 2026 espionage campaigns to Screening Serpens, detailing six MiniUpdate and MiniJunk V2 RAT variants, tailored lures, DLL sideloading and AppDomainManager hijacking that disables .NET security telemetry.
Key points
- Unit 42 attributes the campaigns to Iran-nexus group Screening Serpens with moderate-high confidence; VirusTotal metadata suggests targets in the U.S., Israel, the UAE and other Middle Eastern entities.
- Researchers identified six RAT variants deployed between February and April 2026, grouped into the MiniUpdate and MiniJunk V2 families.
- The campaigns used tailored recruitment and meeting-themed lures to persuade targets to download malicious archives; researchers found no evidence that impersonated organizations’ infrastructure was breached.
- The infection chains used legitimate executables to sideload malicious DLLs, with scheduled tasks establishing persistence.
- MiniUpdate used AppDomainManager hijacking and configuration directives to disable ETW and other .NET security mechanisms before payload execution, reducing visibility to endpoint defenses.
- The RATs support command execution, process manipulation and file exfiltration; newer MiniUpdate variants added chunked uploads, while MiniJunk V2 used obfuscation and sandbox-evasion checks.
Article Details
- Attack Vectors
- Personalized recruitment and meeting-themed lures directed targets to spoofed pages or malicious archives, prompting them to download and manually run the payload.
- Malicious DLLs were sideloaded by legitimate executables, including Setup.exe, update.exe, and SoftwareLicencing.exe.
- AppDomainManager hijacking used modified .NET configuration files to load attacker-controlled assemblies before host applications started and disable security telemetry or validation.
- The malware established persistence with scheduled tasks and used HTTP C2 for command execution, process manipulation, and file exfiltration.
- Defensive Notes
- Treat DLL sideloading and AppDomainManager hijacking as high-risk behaviors, and monitor trusted or signed binaries loading untrusted modules.
- Tune EDR to detect configuration changes that disable ETW, strong-name verification, or publisher policies.
- Use URL and DNS protections to identify or block the reported malicious domains and URLs; the article says Palo Alto Networks updated protections for the shared indicators.
- The article reports that Cortex XDR detected and prevented the MiniJunk V2 sideloading chain before user interaction.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | buisness-centeral-transportation[.]azurewebsites[.]net | MiniUpdate C2 domain contacted for command polling. |
| DOMAIN | buisness-centeral-transportation[.]com | MiniUpdate C2 domain contacted for command polling. |
| DOMAIN | buisness-centeral[.]azurewebsites[.]net | MiniUpdate C2 domain contacted for command polling. |
| DOMAIN | elementshift[.]azurewebsites[.]net | Azure-hosted C2 domain used by the MiniJunk V2 Connection.dll RAT. |
| DOMAIN | licencemanagers[.]azurewebsites[.]net | MiniJunk V2 C2 domain that mimics a Windows service name. |
| DOMAIN | licencesupporting[.]azurewebsites[.]net | MiniJunk V2 C2 domain that mimics a Windows service name. |
| DOMAIN | nanomatrix[.]azurewebsites[.]net | Azure-hosted C2 domain used by the MiniJunk V2 Connection.dll RAT. |
| DOMAIN | peerdistsvcmanagers[.]azurewebsites[.]net | MiniJunk V2 C2 domain that mimics a Windows service name. |
| DOMAIN | premierhealthadvisory[.]azurewebsites[.]net | Reported rotating MiniUpdate C2 domain hosted on Azure and used to impersonate a health-sector entity. |
| DOMAIN | premierhealthadvisory[.]com | Reported rotating MiniUpdate C2 domain used to impersonate a health-sector entity. |
| DOMAIN | quantumweave[.]azurewebsites[.]net | Azure-hosted C2 domain used by the MiniJunk V2 Connection.dll RAT. |
| DOMAIN | ramiltonsfinance[.]azurewebsites[.]net | Reported rotating MiniUpdate C2 domain hosted on Azure and used to impersonate a financial-sector entity. |
| DOMAIN | ramiltonsfinance[.]com | Reported rotating MiniUpdate C2 domain used to impersonate a financial-sector entity. |
| DOMAIN | themesmanagers[.]azurewebsites[.]net | MiniJunk V2 C2 domain that mimics a Windows service name. |
| DOMAIN | themesprovidermanagers[.]azurewebsites[.]net | MiniJunk V2 C2 domain that mimics a Windows service name. |
| SHA256 | 0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864 | Hash of the MiniUpdate payload UpdateChecker.dll. |
| SHA256 | 332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17 | Hash of the malicious Hiring Portal.zip archive used in the MiniUpdate U.S. campaign. |
| SHA256 | 38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11c | Hash of the initial archive used in the MiniUpdate Israel campaign. |
| SHA256 | 43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa | Hash of the Connection.dll RAT payload used in the MiniJunk V2 U.S. campaign. |
| SHA256 | 44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250 | Hash of the initial archive used in the MiniUpdate U.S. campaign. |
| SHA256 | 74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27 | Hash of a MiniUpdate sample listed for the reported Middle Eastern campaign. |
| SHA256 | 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b | Hash of the Portable Platform.zip archive used in the MiniJunk V2 U.S. campaign. |
| SHA256 | 9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84 | Hash of the malicious uevmonitor.dll used in the MiniJunk V2 Middle Eastern campaign. |
| SHA256 | 9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1 | Hash of the malicious unbcl.dll used in the MiniJunk V2 U.S. campaign. |
| SHA256 | b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4 | Hash of the malicious unbcl.dll listed for the MiniJunk V2 Middle Eastern campaign. |
| SHA256 | bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad | Hash of a MiniUpdate UpdateChecker.dll sample associated with the reported UAE campaign. |
| SHA256 | d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2 | Hash of the MiniUpdate Israel campaign UpdateChecker.dll payload. |
| URL | hxxps[:]//2117[.]filemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm | Specific file-sharing URL that delivered the malicious archive after the phishing page redirected the victim. |
| URL | hxxps[:]//docspace-twpf0e[.]onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content.zip?filename=remote.[REDACTED].zip | Specific ONLYOFFICE DocSpace resource listed as a malicious archive-delivery URL. |
MITRE ATT&CK
T1005 · Data from Local SystemThe RATs collected files from compromised hosts and supported uploading them, including in chunks.T1027 · Obfuscated Files or InformationMiniJunk V2 used junk code, padding, and Mixed Boolean-Arithmetic and XOR obfuscation; MiniUpdate also decrypted configuration strings.T1036 · MasqueradingLures and malware components impersonated trusted employers, conferencing software, Windows service names, and installer interfaces.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrated files and status reports through its C2 infrastructure.T1053.005 · Scheduled TaskThe malware created scheduled tasks for persistence, including a daily task and logon-triggered tasks.T1057 · Process DiscoveryMiniUpdate enumerated running processes and could terminate them.T1059.003 · Windows Command ShellMiniUpdate executed shell commands through cmd.exe /c.T1071.001 · Web ProtocolsThe RATs communicated with C2 infrastructure over HTTP, including GET polling and POST beaconing.T1105 · Ingress Tool TransferPayloads were delivered or retrieved through external file-sharing and attacker-managed hosting resources.T1204.002 · Malicious FileThe infection chain began when a victim manually ran Setup.exe from a downloaded archive.T1497.001 · System ChecksThe malware checked process and parent-process names and used execution checks intended to avoid sandbox analysis.T1562.001 · Disable or Modify ToolsAppDomainManager configuration directives disabled ETW and bypassed strong-name and publisher-policy validation to reduce security visibility.T1566.002 · Spearphishing LinkThe campaigns used spoofed recruitment and meeting URLs to direct targets to phishing pages and malicious archive downloads.T1574.002 · DLL Side-LoadingMalicious DLLs were loaded through legitimate executables including Setup.exe, update.exe, and SoftwareLicencing.exe.
Threat Actors
Nimbus ManticoreThe article identifies Smoke Sandstorm as an alternate name for Screening Serpens; Unit 42 assesses with moderate-high confidence that the group conducted the described campaigns.Screening SerpensUnit 42 assesses with moderate-high confidence that Screening Serpens conducted the described espionage campaigns using MiniUpdate and MiniJunk V2.UNC1549The article identifies UNC1549 as an alternate name for Screening Serpens; Unit 42 assesses with moderate-high confidence that the group conducted the described campaigns.
Malware
MiniFastThe group used highly tailored recruitment and meeting-themed lures, DLL sideloading, and AppDomainManager hijacking to deliver MiniUpdate and MiniJunk V2 while evading detection and exfiltrating data.MiniJunk V2The group used highly tailored recruitment and meeting-themed lures, DLL sideloading, and AppDomainManager hijacking to deliver MiniUpdate and MiniJunk V2 while evading detection and exfiltrating data.
Vendors
MicrosoftPublisher policies are typically used by Microsoft to redirect application bindings to newer, safer or patched versions of an assembly.ONLYOFFICE[T1102 ] Web Service – Used Azure-hosted domains and ONLYOFFICE DocSpace instances to stage files and manage infrastructure.Palo Alto NetworksPalo Alto Networks customers are better protected from the threats described in this article through the following products and services:
Products
.NETThe most notable technical shift was AppDomainManager hijacking, which disabled .NET security mechanisms and reduced EDR visibility before payload execution.Azure[T1102 ] Web Service – Used Azure-hosted domains and ONLYOFFICE DocSpace instances to stage files and manage infrastructure.Cortex XDRThe sideloading chain and malicious executable triggered Cortex XDR to flag this threat as high risk.Microsoft Windows[T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – Executed shell commands through cmd.exe.ONLYOFFICE DocSpace[T1102 ] Web Service – Used Azure-hosted domains and ONLYOFFICE DocSpace instances to stage files and manage infrastructure.
Tools
Countries
IranUnit 42 attributes a multi-stage espionage campaign to the Iran-nexus APT group Screening Serpens, which deployed six new RAT variants against targets in the U.S., Israel, the UAE, and other Middle Eastern entities.IsraelUnit 42 attributes a multi-stage espionage campaign to the Iran-nexus APT group Screening Serpens, which deployed six new RAT variants against targets in the U.S., Israel, the UAE, and other Middle Eastern entities.UAEUnit 42 attributes a multi-stage espionage campaign to the Iran-nexus APT group Screening Serpens, which deployed six new RAT variants against targets in the U.S., Israel, the UAE, and other Middle Eastern entities.United StatesUnit 42 attributes a multi-stage espionage campaign to the Iran-nexus APT group Screening Serpens, which deployed six new RAT variants against targets in the U.S., Israel, the UAE, and other Middle Eastern entities.
Industries
AerospaceDuring these campaigns, Screening Serpens consistently set its sights on high-value sectors, heavily targeting aerospace, defense manufacturing and telecommunications organizations.Defense manufacturingDuring these campaigns, Screening Serpens consistently set its sights on high-value sectors, heavily targeting aerospace, defense manufacturing and telecommunications organizations.TechnologyThe campaigns targeted entities in the U.S., Israel, the UAE, and likely additional Middle Eastern organizations, with a strong focus on technology-sector professionals.TelecommunicationsDuring these campaigns, Screening Serpens consistently set its sights on high-value sectors, heavily targeting aerospace, defense manufacturing and telecommunications organizations.