Six new RAT variants in six weeks, C2 traffic goes through Microsoft Azure, initial infection is disguised as the recruitment process in a global airline. Samples are loaded to VirusTotal from organizations in the US and Israel - this is the Unit 42 data, not abstract "experts count".
For SOC, the system problem is buried here: C2 traffic to Azure domains is indistinguishable from legitimate appeals, the persistence mechanism disables the application’s protection through its own .config file – and none of these events generates a standard alat. Not one at all.
Screening Serpens APT: Who is behind UNC1549 Dream Job attack
Screening Serpens is a designation for the Palo Alto Networks for a group that Mandiant leads as UNC1549, Microsoft is like Smoke Sandstorm, and the industry often calls the Iranian Dream Job. The group is active since at least 2022, working for Iranian intelligence - in the context of other Iranian and not only APT campaigns of this period, focus on Full map of APT-groups 2025-2026 and specializes in cyber espionage in the aerospace, defense and technology sectors.
The goal is long-term secretive access to internal networks to collect intelligence. UNC1549 purposefully hits organizations in R&D, satellite communications and defense logistics. Victims were recorded in the United States, Great Britain, France, Germany, Israel and the UAE. What is leaking: project documentation, data on satellite systems, internal correspondence of key engineers.
According to Unit 42, Screening Serpens has expanded operations to Western Europe. With the aggravation of the regional conflict, the operational pace jumped sharply: six new RAT options in the two families are compiled and deployed in a matter of weeks. These are not one-time attacks - these are coordinated waves: samples of one family were loaded on VirusTotal from organizations in different countries at intervals on days.
For threat intelligence: UNC1549 shows a direct correlation between geopolitical events and the intensity of cyberattacks. For SOC organizations from the target sectors, the aggravation of the situation in the Middle East is a signal to increase the level of monitoring. According to Mandiant M-Trends 2025, exploits remain the most common source of initial access (38%), but Screening Serpens proves that targeted phishing with social engineering still works perfectly against technicians.
Kill chain UNC1549: from Job Lure phishing to cloud C2
The infection chain starts with targeted phishing through recruiting baits - a Dream Job variant adapted for specific positions. Next - DLL gaining, AppDomainManager hijacking to disable application protection, securing through Registry Run Keys and C2 via Azure.
Initial delivery: Job Lure Phishing and Cyber Espionage
In the campaign against organizations in the United States, the attackers used an archive that simulates the portal of hiring a global airline. The ZIP file contained an implicated archive Hiring Portal.zip and six PDF documents with job descriptions: Senior Software Engineer Job ID JR205894.pdf and similar. The documents included detailed position requirements – specific Job IDs, technical skills, grade levels. The calculation is simple: the engineer will open the descriptions, will be interested and unpack the nested archive.
Unit 42 found no signs of compromising the airline’s infrastructure. The imitation was limited to branding and corporate style - but this is enough for the victim not to suspect the substitution.
At launch setup.exe from Hiring Portal.zip A fake error window with the heading "Hiring Portal.zip" is opened. The user sees the expected behavior - "the portal has not loaded" - and does not notice that payload is already spinning in the background. Beautifully done, you can't say anything.
DLLloading and EDR bypass via AppDomainManager hijacking
After launch setup.exe The chain goes to DLLloading: the legitimate executable file downloads a replaced DL library (in the case of MiniUpdate - UpdateChecker.dll)
And then - the most interesting thing in this campaign. AppDomainManager hijacking. It's not an exploit, it's not zero-day. The mechanism works as follows:
The attackers create a .config file for the target. NET-applications
The configuration indicates the custom AppDomainManager - a class that CLR loads and executes before доthe launch of the main application code
The code of the custom AppDomainManager proactively disables its own security mechanisms of the application
After disabling the protection, the main RAT-payload is loaded
Why EDR misses it: .config file is not executable. Assumption loading through AppDomainManager is a regular operation CLR provided by architecture. NET. Most EDRs with user-mode hooks (SentinelOne, early versions of CrowdStrike Falcon) are sharpened to process injection, API hooking and shellcode execution. Loading. NET builds through a legitimate configuration mechanism does not fit into these categories. EDR with kernel ETW-TI (Elastic 8.x+) has more observation points. NET runtime, but the custom rule for the anomalous AppDomainManager detectable from the box is not delivered - it must be assembled manually for a specific environment.
In fact, the attackers use the application against themselves. CLR obediently downloads what is written in config. Documented behavior. All according to the specification.
Persistence and C2 communications
Fixing - through Registry Run Keys (T1547.001, Persistence) Similar to APT33, which, according to Picus Security, masks the Run-key under the name SharePoint.exeScreening Serpens uses names that simulate legitimate processes.
C2-communications go via HTTPS to Azure-hosted domains (T1071.001, Command and Control) Architectural solution: each target and RAT option are distinguished by a set of 3-5 unique C2 domains placed on Azure. Disclosure of C2 one campaign does not reveal others. Good operating discipline.
Unit 42 classified six detected RAT variants into two families.
MiniBike - four options deployed by two coordinated waves. Between the options are recorded: rotation of opcode-mapping (each build stirs the code of commands, nullifying the signature detect), adding fragmented file extortion in April versions and complete rotation of C2 domains while maintaining the RAT architecture.
According to VirusTotal metadata, samples were loaded from organizations in the United States, Israel, the UAE and other Middle Eastern countries at intervals on days.
MiniBus - two options, the evolution of a previously documented family. The first model is aimed at organizing in the Middle East, the second in the United States.
And here’s the important thing: Unit 42 emphasizes that there was no “significant evolution” between the variants of MiniBike. Surface changes: recharge opcodes and C2 rotation nullify signatures, but RAT architecture is stable. For detection, this is fundamental - a behavioral detect is more reliable than signature, because the pattern "DLL load from the user directory -> HTTPS-beacon to the Azure domain -> Registry Run Key" is reproduced in all options without exception.
Cloud infrastructure C2: Iranian hackers and Live-off-the-cloud
C2 router through Azure is not the invention of Screening Serpens. According to Picus Security, APT33 (a related Iranian group) has previously issued fraudulent Azure subscriptions for C2, using impromptu Azure for Students accounts. Screening Serpens takes the same approach, but with more discipline: 3-5 unique domains for each target, zero reusing between campaigns.
Why the standard SOC does not see this C2 traffic:
Domains *.azurewebsites.net and adjacent Azure zones sit in firewall streamlines - traffic passes without inspection
Destination IP owned by Microsoft - SIEM is silent
Each campaign uses new domains - IOCs from previous attacks are useless
Azure issues valid TLS-certificate automatically - JA3-fingerprint not anomalous
According to CrowdStrike Global Threat Report 2025, the number of cloud intrusion cases increased by 26% year-on-year, and the average field time movement after initial access is 62 minutes (record - 51 seconds). If the initial phishing is missed and C2 through Azure is not detected, the attackers have an hourly window to fix. Without a single alerta.
This approach is part of the trend Live-off-the-cloud: Legitimate Cloud Services Instead of its own C2 infrastructure. For SOC, this is a shift: network indicators stop working, the detect is shifted to behavioral analysis of endpoint.
For SOC, the system problem is buried here: C2 traffic to Azure domains is indistinguishable from legitimate appeals, the persistence mechanism disables the application’s protection through its own .config file – and none of these events generates a standard alat. Not one at all.
Screening Serpens APT: Who is behind UNC1549 Dream Job attack
Screening Serpens is a designation for the Palo Alto Networks for a group that Mandiant leads as UNC1549, Microsoft is like Smoke Sandstorm, and the industry often calls the Iranian Dream Job. The group is active since at least 2022, working for Iranian intelligence - in the context of other Iranian and not only APT campaigns of this period, focus on Full map of APT-groups 2025-2026 and specializes in cyber espionage in the aerospace, defense and technology sectors.
The goal is long-term secretive access to internal networks to collect intelligence. UNC1549 purposefully hits organizations in R&D, satellite communications and defense logistics. Victims were recorded in the United States, Great Britain, France, Germany, Israel and the UAE. What is leaking: project documentation, data on satellite systems, internal correspondence of key engineers.
According to Unit 42, Screening Serpens has expanded operations to Western Europe. With the aggravation of the regional conflict, the operational pace jumped sharply: six new RAT options in the two families are compiled and deployed in a matter of weeks. These are not one-time attacks - these are coordinated waves: samples of one family were loaded on VirusTotal from organizations in different countries at intervals on days.
For threat intelligence: UNC1549 shows a direct correlation between geopolitical events and the intensity of cyberattacks. For SOC organizations from the target sectors, the aggravation of the situation in the Middle East is a signal to increase the level of monitoring. According to Mandiant M-Trends 2025, exploits remain the most common source of initial access (38%), but Screening Serpens proves that targeted phishing with social engineering still works perfectly against technicians.
Kill chain UNC1549: from Job Lure phishing to cloud C2
The infection chain starts with targeted phishing through recruiting baits - a Dream Job variant adapted for specific positions. Next - DLL gaining, AppDomainManager hijacking to disable application protection, securing through Registry Run Keys and C2 via Azure.
Initial delivery: Job Lure Phishing and Cyber Espionage
In the campaign against organizations in the United States, the attackers used an archive that simulates the portal of hiring a global airline. The ZIP file contained an implicated archive Hiring Portal.zip and six PDF documents with job descriptions: Senior Software Engineer Job ID JR205894.pdf and similar. The documents included detailed position requirements – specific Job IDs, technical skills, grade levels. The calculation is simple: the engineer will open the descriptions, will be interested and unpack the nested archive.
Unit 42 found no signs of compromising the airline’s infrastructure. The imitation was limited to branding and corporate style - but this is enough for the victim not to suspect the substitution.
At launch setup.exe from Hiring Portal.zip A fake error window with the heading "Hiring Portal.zip" is opened. The user sees the expected behavior - "the portal has not loaded" - and does not notice that payload is already spinning in the background. Beautifully done, you can't say anything.
DLLloading and EDR bypass via AppDomainManager hijacking
After launch setup.exe The chain goes to DLLloading: the legitimate executable file downloads a replaced DL library (in the case of MiniUpdate - UpdateChecker.dll)
And then - the most interesting thing in this campaign. AppDomainManager hijacking. It's not an exploit, it's not zero-day. The mechanism works as follows:
The attackers create a .config file for the target. NET-applications
The configuration indicates the custom AppDomainManager - a class that CLR loads and executes before доthe launch of the main application code
The code of the custom AppDomainManager proactively disables its own security mechanisms of the application
After disabling the protection, the main RAT-payload is loaded
Why EDR misses it: .config file is not executable. Assumption loading through AppDomainManager is a regular operation CLR provided by architecture. NET. Most EDRs with user-mode hooks (SentinelOne, early versions of CrowdStrike Falcon) are sharpened to process injection, API hooking and shellcode execution. Loading. NET builds through a legitimate configuration mechanism does not fit into these categories. EDR with kernel ETW-TI (Elastic 8.x+) has more observation points. NET runtime, but the custom rule for the anomalous AppDomainManager detectable from the box is not delivered - it must be assembled manually for a specific environment.
In fact, the attackers use the application against themselves. CLR obediently downloads what is written in config. Documented behavior. All according to the specification.
Persistence and C2 communications
Fixing - through Registry Run Keys (T1547.001, Persistence) Similar to APT33, which, according to Picus Security, masks the Run-key under the name SharePoint.exeScreening Serpens uses names that simulate legitimate processes.
C2-communications go via HTTPS to Azure-hosted domains (T1071.001, Command and Control) Architectural solution: each target and RAT option are distinguished by a set of 3-5 unique C2 domains placed on Azure. Disclosure of C2 one campaign does not reveal others. Good operating discipline.
Unit 42 classified six detected RAT variants into two families.
MiniBike - four options deployed by two coordinated waves. Between the options are recorded: rotation of opcode-mapping (each build stirs the code of commands, nullifying the signature detect), adding fragmented file extortion in April versions and complete rotation of C2 domains while maintaining the RAT architecture.
According to VirusTotal metadata, samples were loaded from organizations in the United States, Israel, the UAE and other Middle Eastern countries at intervals on days.
MiniBus - two options, the evolution of a previously documented family. The first model is aimed at organizing in the Middle East, the second in the United States.
And here’s the important thing: Unit 42 emphasizes that there was no “significant evolution” between the variants of MiniBike. Surface changes: recharge opcodes and C2 rotation nullify signatures, but RAT architecture is stable. For detection, this is fundamental - a behavioral detect is more reliable than signature, because the pattern "DLL load from the user directory -> HTTPS-beacon to the Azure domain -> Registry Run Key" is reproduced in all options without exception.
Cloud infrastructure C2: Iranian hackers and Live-off-the-cloud
C2 router through Azure is not the invention of Screening Serpens. According to Picus Security, APT33 (a related Iranian group) has previously issued fraudulent Azure subscriptions for C2, using impromptu Azure for Students accounts. Screening Serpens takes the same approach, but with more discipline: 3-5 unique domains for each target, zero reusing between campaigns.
Why the standard SOC does not see this C2 traffic:
Domains *.azurewebsites.net and adjacent Azure zones sit in firewall streamlines - traffic passes without inspection
Destination IP owned by Microsoft - SIEM is silent
Each campaign uses new domains - IOCs from previous attacks are useless
Azure issues valid TLS-certificate automatically - JA3-fingerprint not anomalous
According to CrowdStrike Global Threat Report 2025, the number of cloud intrusion cases increased by 26% year-on-year, and the average field time movement after initial access is 62 minutes (record - 51 seconds). If the initial phishing is missed and C2 through Azure is not detected, the attackers have an hourly window to fix. Without a single alerta.
This approach is part of the trend Live-off-the-cloud: Legitimate Cloud Services Instead of its own C2 infrastructure. For SOC, this is a shift: network indicators stop working, the detect is shifted to behavioral analysis of endpoint.
