Palo Alto Networks Tracks Iranian Threat Using Fake Job Ads To Target Organisations In The US, Israel And UAE

An Iranian-linked cyber espionage group has been deploying new malware and evasion techniques against organisations in the United States, Israel and the United Arab Emirates, using fake job recruitment lures to trick technical professionals into compromising their own systems.

Researchers at Palo Alto Networks’ Unit 42 threat intelligence team have documented the campaigns, which they attribute with moderate-high confidence to a group they track as Screening Serpens. The group is also known in the security community as Smoke Sandstorm, Iranian Dream Job and UNC1549.

The campaigns ran from mid-February through April 2026, a period that aligns with the regional conflict that started in the Middle East on February 28, 2026. Unit 42 identified six new remote access Trojan (RAT) variants developed and deployed during that window, grouped into two new malware families the researchers have named MiniUpdate and MiniJunk V2.

Fake job ads as the entry point

Screening Serpens has borrowed a tactic associated with North Korean threat actors: using highly tailored recruitment lures to target software engineers and other technical professionals. The group impersonated recognisable brands and hiring platforms to build trust before tricking targets into initiating the infection chain themselves.

In one campaign targeting a US entity, attackers delivered a malicious archive disguised as recruitment materials from a global air carrier. The ZIP file contained six PDF documents with fabricated job requisitions for roles such as Senior Software Engineer and IT Project and Applications Manager, each complete with specific job IDs to appear authentic. Nested inside was a second archive containing the actual malware payload.

In a separate campaign targeting an Israeli entity, the group impersonated a video conferencing platform. Attackers first sent the target several legitimate meeting links to establish trust, then followed up with a lookalike domain hosting a phishing page designed to mimic an authentic meeting invitation. The page contained hidden JavaScript that redirected the victim’s download request to a malicious payload hosted on a third-party file-sharing service.

A third campaign, targeting a professional in the technology sector based in a Middle Eastern country, exploited the target’s active job-hunting presence online. The attackers shared a spoofed recruitment URL from a well-known employment website – one that intentionally returned a 404 error to prompt the target to accept an alternative download from an attacker-controlled workspace.

Unit 42 found no indication in any of these campaigns that the impersonated organisations’ infrastructure had been breached. The brands were used solely for social engineering purposes.

A new evasion technique disables security from inside

The most notable technical development in the campaigns is the group’s adoption of a technique called AppDomainManager hijacking. This method manipulates the initialisation phase of .NET applications to execute malicious code before the host application even starts, effectively allowing the malware to disable logging and security mechanisms that endpoint detection tools rely on.

By adding specific directives to a legitimate .NET configuration file, the attackers instruct the runtime environment to silently disable Event Tracing for Windows (ETW) – the primary telemetry source used by endpoint detection and response (EDR) solutions to monitor .NET activity. The configuration also bypasses cryptographic signature validation for loaded code libraries and prevents the system from redirecting to newer, patched versions of software components.

Unit 42 described the approach as a “mature living-off-the-land” technique. Rather than writing complex shellcode to disable security monitors – actions that often trigger behavioural alerts – the group asks the .NET runtime to turn off its own security mechanisms through a legitimate configuration file.

The result is that the malicious payload runs in what the researchers described as “an entirely unmonitored, highly privileged context.”

Two malware families deployed in parallel

The six RAT variants were split across two malware families deployed in concurrent campaigns.

MiniUpdate, the first family, was observed in four variants targeting entities in the US and Israel in late March 2026, and in the UAE and another Middle Eastern country in mid-April. The malware operates via external command-and-control servers hosted predominantly on Microsoft Azure, cycling through three to five unique domains per target to prevent cross-contamination between campaigns.

The March variants used a 16-command dispatcher giving attackers control over file operations, shell execution and process manipulation. By April, this had expanded to 18 commands, with the addition of a capability to break large files into smaller chunks during upload for stealthier data exfiltration.

MiniJunk V2, the second family, is an evolved version of previously documented MiniJunk malware. A sample targeting a Middle Eastern entity surfaced on February 17, 2026 – before the regional conflict began – while a variant potentially targeting a US entity appeared on March 27. The malware inflates its file size to around 12 MB by packing thousands of junk strings into its code, including fake Java and Python error messages, to overwhelm analysis tools and bypass automated sandbox file-size limits.

Multi-stage infection chains

Both malware families use multi-stage infection chains that combine DLL sideloading with the AppDomainManager hijacking technique.

In the MiniUpdate chain, the initial payload displays a fake loading spinner to the victim while silently copying files into hidden directories, then creates a scheduled task to maintain persistence across system reboots. A second stage performs anti-analysis checks, verifying it was launched by the correct parent process to detect whether it is running inside a security sandbox.

The MiniJunk V2 chain follows a similar pattern, using decoy error windows and fake “Meeting Room” interfaces to keep victims occupied while the malware establishes its command-and-control connection in the background. One variant included a hard-coded date check ensuring it would not execute before March 27, 2026 at 1:30 PM UTC – a mechanism the researchers assessed was designed to avoid premature detection during sandbox analysis.

Command-and-control infrastructure mimics legitimate services

Both malware families route their traffic through Azure-hosted domains designed to blend in with legitimate network activity. MiniJunk V2 used domains mimicking Windows service names, while the March MiniUpdate campaign used domains with deliberate misspellings of business terms. The April variants rotated to domains impersonating health and financial sector entities.

Each variant uses a different set of three to five command-and-control domains, dedicated to specific targets. The researchers noted this compartmentalisation is designed to increase operational resilience by preventing the compromise of one campaign from exposing others.

Defenders urged to focus on behavioural detection

Elad Koren, VP of Product Management at Palo Alto Networks, urged organisations to move beyond signature-based defences.

“As APT groups like Screening Serpens continue to evolve and leverage advanced frontier AI technologies, legacy endpoint security solutions are no longer enough,” Koren warned. “Modern organisations now require defensive postures that transition toward multi-layered, behavioral-based strategies that look beyond simple file signatures.”

“By focusing on identifying inherently anomalous behaviors at the point of installation, in this case AppDomain hijacking or the disabling of system telemetry, defenders can effectively intercept attack chains before they take root,” Koren added. “Monitoring application logic and behavior is now foundational to proactive threat prevention.”

Unit 42 recommended that defenders ensure EDR tools are tuned to detect DLL sideloading and AppDomainManager hijacking specifically, treating these execution techniques as high risk rather than relying solely on known malware indicators. The researchers noted that as of April 2026, Screening Serpens activity shows no signs of slowing and organisations should expect further attempts.

Targeting pattern reflects strategic objectives

Screening Serpens has been active since at least 2022 and has historically focused on aerospace, defence manufacturing and telecommunications organisations. The group expanded into Western Europe in late 2025, as documented by Check Point Research.

The timing and targeting of the 2026 campaigns align with Iranian intelligence objectives during the regional conflict. Unit 42 assessed the group has maintained a consistently high operational tempo throughout March and April 2026, with the campaigns reflecting a continuous cycle of malware development and deployment.

The full technical analysis, including indicators of compromise, is available on the Unit 42 blog.

Last Updated on May 27, 2026 by Nick Ross