A report by Palo Alto Networks' Unit 42 reveals that an Iran-linked cyber espionage group, Screening Serpens, has targeted entities in the United States, Israel, and the United Arab Emirates during a campaign from mid-February to April 2026. This timing coincided with escalating regional tensions and Operation Roaring Lion. The group, also known by aliases like UNC1549 and Smoke Sandstorm, is described as an advanced persistent threat (APT) aligned with Iranian intelligence objectives. The report identifies six new remote access Trojan (RAT) variants developed during this period, organized into two families: MiniUpdate and MiniJunk V2. Notably, the group employed AppDomainManager hijacking, a technique that compromises .NET applications' security. Screening Serpens primarily targets technology professionals through tailored social engineering tactics, including fake job offers that impersonate trusted brands. Despite their sophisticated methods, no breaches of the impersonated organizations' infrastructure were found. Unit 42 warns that Screening Serpens shows no signs of slowing down, indicating a need for organizations to strengthen their cybersecurity defenses against future attacks.