Back Gbhackers

MiniUpdate RAT Abuses Azure C2 for Targeted Espionage

Gbhackers •Mayura Kathir • May 25, 2026

A sophisticated espionage campaign by the Iran-nexus advanced persistent threat group known as Screening Serpens also tracked as UNC1549 and Smoke Sandstorm deploying a newly identified remote access Trojan (RAT) family called MiniUpdate against targets in the United States, Israel, and the United Arab Emirates. Screening Serpens has been active since at least 2022, but […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iran-linked Screening Serpens Group Deploys MiniUpdate RAT via Azure C2 The Screening Serpens group, linked to Iran, has initiated a targeted espionage campaign using a new remote access Trojan (RAT) named MiniUpdate. This campaign primarily targets technology professionals in the United States, Israel, and the United Arab Emirates. The attacks utilize Azure-hosted command and control (C2) domains, employing deceptive recruitment lures and fake software installers to distribute the malware. The campaign reportedly began in mid-February 2026 and has raised significant concerns among cybersecurity experts due to its sophisticated methods. Screening Serpens has been active since at least 2022, indicating a long-term strategic focus on espionage. The exact number of affected individuals or organizations remains unclear, but the implications for national security are substantial. 2 sources 73

Extracted Entities

MiniUpdate RAT Abuses Azure C2 for Targeted Espionage

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Companies (1)

Countries (3)

Malware (1)

MITRE ATT&CK (1)