Iranian Hackers Abuse AppDomainManager Hijacking to Evade EDR

Key Takeaways

• An Iran-linked APT group, known as Screening Serpens (UNC1549, Smoke Sandstorm, Iranian Dream Job), has intensified cyberespionage campaigns.
• The group is targeting organizations in the United States, Israel, and the United Arab Emirates, with a focus on aerospace, defense manufacturing, and telecommunications sectors.
• Attackers are employing a sophisticated .NET AppDomainManager hijacking technique to bypass Endpoint Detection and Response (EDR) systems.
• New remote access Trojans (RATs), MiniUpdate and MiniJunk V2, are being delivered via spear phishing with fake job listings and meeting invitations.
• Defenders should enhance EDR tuning to detect DLL sideloading and AppDomainManager hijacking behaviors, moving beyond signature-based detection.

Iranian state-sponsored hackers have significantly advanced their cyberespionage capabilities, now utilizing a highly sophisticated .NET hijacking method to circumvent endpoint security measures. This aggressive campaign targets critical organizations across the United States, Israel, and the United Arab Emirates. The escalation in activity closely follows a regional conflict that commenced on February 28, 2026, according to a detailed report.

Security researchers are observing a relentless increase in these operations. The threat group, identified as Screening Serpens (also known by aliases such as UNC1549, Smoke Sandstorm, and Iranian Dream Job), has been active since at least 2022. While historically focused on targets within the Middle East, the group expanded its reach into Western Europe in late 2025.

Their primary targets include high-value sectors such as aerospace, defense manufacturing, and telecommunications. The attackers initiate contact through tailored social engineering tactics, using deceptive job postings and fabricated meeting invitations to trick professionals into downloading malicious files.

Unit 42 researchers identified six new remote access Trojan (RAT) variants deployed between February and April 2026. These variants belong to two distinct malware families: MiniUpdate and MiniJunk V2. Unit 42’s report, shared with Cyber Security News (CSN), indicates that these campaigns are synchronized with the conflict timeline. Coordinated attacks struck entities in the U.S. and Israel in late March, followed by targets in the UAE and another Middle Eastern nation in mid-April 2026.

Both malware families commence their infection sequences through spear phishing. Victims typically receive archives disguised as recruitment portals or installers for video conferencing applications. Upon interaction, a covert, multi-stage infection process silently unfolds, granting attackers full control over the compromised system.

AppDomainManager Hijacking: A Stealthy Evasion Technique

A critical technical advancement observed in this campaign is the abuse of AppDomainManager hijacking. This technique exploits the initialization phase of .NET applications by subtly altering a legitimate configuration file. This allows the attackers’ malicious code to execute even before the host application fully loads. Because this occurs so early in the execution process, many conventional security tools, including EDRs, often fail to detect the intrusion.

By inserting specific XML lines into the application’s configuration file, attackers direct the .NET runtime to disable its inherent security mechanisms. They specifically deactivate Event Tracing for Windows (ETW), which is a primary data source relied upon by modern EDR platforms for monitoring .NET activity. Furthermore, they bypass strong-name signature validation, enabling the loading of unsigned DLL files without triggering security alerts.

This approach is categorized as a mature “living-off-the-land” technique. It requires no complex shellcode injection or memory patching. Instead, attackers leverage legitimate system functionalities to deactivate defenses using seemingly innocuous configuration files. The result is the execution of a malicious payload within an unmonitored, highly privileged environment, without raising any immediate alarms.

Infection Chain and Social Engineering Tactics

The MiniUpdate malware family was observed being delivered through archived files that impersonated a global airline and a popular video conferencing platform. One such archive contained six fabricated job description PDFs, complete with credible job IDs and titles like “Senior Software Engineer,” specifically targeting IT and engineering professionals. A nested payload within a file named “Hiring Portal.zip” would display a fake error window while silently installing the malware in the background.

For persistent access, the malware leveraged Windows Task Scheduler to create a daily trigger at 09:30 local time. The MiniJunk V2 family, while using an older configuration method, employed extensive code obfuscation and file size inflation to bypass automated scanning limitations. Command-and-control (C2) traffic was routed through Azure-hosted domains that mimicked legitimate Windows service names, significantly complicating network-level detection.

What You Should Do

• Enhance EDR Configuration: Tune EDR platforms to specifically detect and flag behaviors associated with DLL sideloading and AppDomainManager hijacking. Do not rely solely on signature-based detection.
• Monitor for Unsigned Modules: Implement policies to treat trusted, signed binaries that load unsigned modules as high-risk events, triggering immediate alerts for security teams.
• Strengthen Email Security: Deploy advanced email filtering and anti-phishing solutions to detect and block malicious attachments and links, especially those impersonating recruitment or collaboration platforms.
• Employee Training: Conduct regular cybersecurity awareness training for all employees, particularly those in high-value roles (e.g., IT, engineering, executive staff), on identifying social engineering tactics like fake job offers or meeting invitations from unofficial sources.
• Network Monitoring: Implement robust network monitoring to identify suspicious C2 traffic, especially connections to unusual Azure-hosted domains or those mimicking legitimate Windows services.
• Indicators of Compromise (IoCs): Integrate the provided IoCs (domains, URLs, SHA256 hashes) into your security information and event management (SIEM) systems, intrusion detection systems (IDS), and endpoint protection platforms for proactive detection.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.