EDR Evasion

Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away

Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.