Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns

MITRE Techniques

• [T1566.001 ] Spearphishing Attachment – Used tailored recruitment and meeting-themed archives to lure victims into opening malicious content. (‘The group frequently uses personalized recruitment lures’ / ‘the victim into downloading the malicious archive’)
• [T1195.002 ] Compromise Software Dependencies and Development Tools – Delivered malicious payloads through legitimate installers and sideloading chains that relied on trusted software behavior. (‘The malware triggers a spoofed error window’ / ‘legitimate Setup.exe host process’)
• [T1036 ] Masquerading – Impersonated trusted brands, hiring platforms, video conferencing services, and system utilities to appear legitimate. (‘mimic a legitimate installer progress indicator’ / ‘impersonate a global air carrier’)
• [T1574.002 ] Hijack Execution Flow: DLL Side-Loading – Used legitimate executables such as Setup.exe and update.exe to load malicious DLLs. (‘leverages DLL sideloading for execution’ / ‘the legitimate Setup.exe host process’)
• [T1574.006 ] Hijack Execution Flow: Dynamic Linker Hijacking – Forced the application to prioritize attacker-controlled local files via probing paths. (‘the directive’)
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – Executed shell commands through cmd.exe. (‘Executes shell commands via cmd.exe /c’)
• [T1218.011 ] System Binary Proxy Execution: Rundll32 – Loaded and invoked DLL payloads through trusted execution flows. (‘loads arbitrary DLLs directly into memory to run specific exported functions’)
• [T1055 ] Process Injection – Loaded payloads into trusted process memory spaces through hijacked application initialization. (‘allowing the next payload, Updater.dll, to load into an unmonitored memory space’)
• [T1105 ] Ingress Tool Transfer – Retrieved and staged payloads from remote file-sharing and cloud-hosted infrastructure. (‘payload delivery is triggered from a third-party file-sharing service’)
• [T1027 ] Obfuscated Files or Information – Used junk code, padding, XOR, ROT13, and mixed boolean-arithmetic obfuscation to hinder analysis. (‘junk code and padding’ / ‘Mixed Boolean-Arithmetic and XOR obfuscation’)
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – Disabled ETW, strong-name verification, and publisher policies to suppress telemetry and validation. (‘proactively disable logging mechanisms’ / ‘disable its own security mechanisms’)
• [T1546.007 ] Event Triggered Execution: Netsh Helper DLL – Abused AppDomainManager hijacking to execute code before the host application started. (‘Pre-Main() execution’ / ‘before the host application even starts’)
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Created scheduled tasks for persistence and execution, including daily and logon-triggered tasks. (‘creates a scheduled task’ / ‘trigger every day at 09:30 local time’)
• [T1102 ] Web Service – Used Azure-hosted domains and ONLYOFFICE DocSpace instances to stage files and manage infrastructure. (‘hosted by Azure’ / ‘attacker-managed ONLYOFFICE workspace’)
• [T1083 ] File and Directory Discovery – Checked file paths and directories while staging hidden payloads and installation folders. (‘resolves its current directory’ / ‘constructs a new hidden installation path’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – Communicated with C2 servers over HTTP GET and POST requests. (‘Command polling occurs via GET requests’ / ‘beacons to the primary C2 base URL via an HTTP POST request’)
• [T1005 ] Data from Local System – Collected files from compromised hosts for upload and exfiltration. (‘support for chunked uploads’ / ‘uploads files to the C2 server’)
• [T1041 ] Exfiltration Over C2 Channel – Exfiltrated data through the same command-and-control infrastructure used for tasking. (‘Exfiltrates data and sends operational status reports to the threat actor’)
• [T1057 ] Process Discovery – Enumerated running processes to support control and validation checks. (‘Enumerates running processes’)
• [T1068 ] Exploitation for Privilege Escalation – Requested UAC elevation to gain higher privileges. (‘Requests User Account Control (UAC) elevation’)
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – Performed process-name and parent-process validation to avoid sandbox execution. (‘checks if the parent process is svchost.exe’ / ‘If a security analyst or automated sandbox executes the file directly, this check will fail’)
• [T1112 ] Modify Registry – No direct registry technique was described in the article.