Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away

Palo Alto Networks Unit 42 has documented six new remote access trojan variants from the Iran-nexus group it tracks as Screening Serpens, all deployed between February and April 2026. Two families: four builds of a backdoor Unit 42 names MiniUpdate, and two builds of MiniJunk V2, an evolution of a framework Check Point first documented in 2025.

Six builds in roughly ten weeks. Unit 42 places that timeline against the regional conflict that began in the Middle East on 28 February 2026 and says the campaign activity aligns closely with it. Its attribution to an Iran-nexus actor is stated at moderate to high confidence, not as fact — worth carrying through to anything you write on top of it. Victims sat in the United States, Israel, the UAE and two further Middle Eastern entities — aerospace, defence manufacturing, telecommunications and technology — reached through fake job requisitions and spoofed recruitment portals.

That tempo is the detection problem. When a group ships a fresh build every fortnight, your hash feed is a lagging indicator by design. What does not change at that speed is the loader chain. And this time, the loader chain does something the group has not done before.

AppDomainManager hijacking is the part that matters

Screening Serpens has relied on DLL sideloading for years. What Unit 42 calls a first for the group is fusing it with AppDomainManager hijacking — MITRE ATT&CK T1574.014 — which abuses the .NET runtime's assembly-loading sequence so attacker code executes before the host application's Main() method.

The mechanism is a text file. A legitimate, properly signed executable is dropped alongside an XML configuration file that the runtime reads at start-up. Per Unit 42's analysis, the directives written into that file include:

• <etwEnable enabled="false"/> — switches off Event Tracing for Windows inside the process. ETW is the telemetry stream most EDR products depend on for .NET visibility.
• <bypassTrustedAppStrongNames enabled="true"/> — skips strong-name validation, so unsigned assemblies load without raising an exception.
• <publisherPolicy apply="no"/> — prevents the redirections that would otherwise send the load to a legitimate assembly.
• <requiredRuntime safemode="true" imageVersion="v4.0.30319"/> — pins the runtime version the operator tested against.
• <probing privatePath="./"/> — forces the assembly search path into the attacker-controlled directory.

There is no exploit here. This is documented .NET behaviour, invoked by a configuration file sitting next to a correctly signed binary.

The malware does not evade your EDR. It asks the .NET runtime to stop producing the telemetry your EDR reads, and the runtime agrees. The payload can be recompiled nightly. The configuration file cannot change much without breaking the technique.

MiniJunk to MiniJunk V2: what actually changed

Be careful with this one. Unit 42 describes MiniJunk V2 as carrying updated core functionality rather than publishing a function-level diff against the 2025 original, and the report credits Check Point for the earlier documentation. The changes you can actually observe sit in the delivery and evasion layer, not in the RAT's command set.

Size inflation as sandbox evasion

The MiniJunk V2 samples pack their .rdata section with thousands of junk strings — Java and Python stack traces, SQL fragments — in a block Unit 42 says repeats every 0x1E50 bytes. That pushes the binary to roughly 12 MB. The purpose is the file-size ceiling in automated analysis: plenty of sandboxes and mail gateways will not detonate a file that large, and simply pass it.

String protection

MiniUpdate leaves API names and C2 domains as plaintext in .rdata. MiniJunk V2 does not, using mixed Boolean-arithmetic and XOR obfuscation instead. In Connection.dll, the RAT component of the March US sample, Unit 42 identifies a single-byte XOR key of 0x8A protecting the User-Agent string and the C2 domains. One byte is not cryptography. It is a static-signature defeat, and it works precisely against the detections that grep binaries for domain strings.

Persistence, renamed

MiniUpdate registers a scheduled task called WindowsSecurityUpdate, which Unit 42 reports firing daily at 09:30 local time. MiniJunk V2 uses one named Synchronize OS. Both names are picked to survive an analyst scrolling Task Scheduler at speed.

The sloppier half tells you something too

MiniUpdate is the less disciplined family, and that is itself evidence about how it was produced. Unit 42 notes the plaintext strings in .rdata and suggests they point to a rushed deployment cycle or a separate development cell. The loader's configuration cipher reverses the input bytes and then applies ROT13 to alphabetic characters. That is not a serious attempt at concealment.

The anti-analysis logic is sharper than the obfuscation. MiniUpdate's gatekeeper stage confirms the running process is named update.exe and that its parent process is svchost.exe. Because persistence runs through a scheduled task, svchost is the natural parent in a genuine infection; a sample detonated directly in a sandbox fails the check and terminates silently. If your automated pipeline returns a benign verdict on a suspicious archive whose payload did nothing at all, that verdict is worth nothing.

MiniUpdate payloads also arrived digitally signed. Unit 42 describes the signature as that of a software company and says it appears to have been stolen or impersonated — the report does not resolve which, and neither should you.

Detections that survive a recompile

What to do this week

1. Write a rule for creation of any file matching .exe.config outside Program Files and outside your software deployment paths. Expect noise from developer workstations; tune by user group, not by suppressing the rule.
2. Sweep endpoints for the string etwEnable across configuration files. This is a one-off scan with a very low false-positive rate and it finds the technique regardless of which payload follows.
3. Confirm your sandbox and mail gateway file-size limits, then compare them against 12 MB. If a 12 MB executable bypasses detonation, the group already knows.
4. Treat a signed binary loading an unsigned module from its working directory as high severity, not informational. Unit 42's own recommendation is that organisations tune EDR specifically for DLL sideloading and AppDomainManager hijacking, and that only works if the alert is not auto-closed.
5. Alert on scheduled tasks named WindowsSecurityUpdate and Synchronize OS as a stopgap, but do not stop there. Those names will change; the creation pattern will not.
6. Brief recruitment-adjacent staff and anyone whose role is public on job boards. The lures in this campaign were built around real job IDs and real employer branding.

One group, six names

Screening Serpens is also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore, Subtle Snail, GalaxyGato and Mirage Kitten, depending on whose feed you subscribe to. Group-IB, reporting in late August 2026, called the same actor one of the most active Iranian APT groups and described further tooling — an SSH-based reverse tunneller and a C++ backdoor overlapping with the TWOSTROKE implant — alongside infrastructure spanning Europe and the Middle East.

The naming sprawl reaches the malware too. Check Point tracks a 2026 Screening Serpens backdoor as MiniFast; reporting on both vendors' work has treated that as the same thing Unit 42 calls MiniUpdate. If your intelligence pipeline deduplicates on family name, you are either double-counting one campaign or missing half of it. Deduplicate on the loader chain instead. That is the part the operators have to keep.