Iran-linked hackers have upgraded their tradecraft by using AppDomainManager hijacking in .NET applications to turn off security telemetry before malicious code fully starts, making endpoint detection and response tools much harder to spot the attack.
The campaign, attributed to the Iran-nexus group Screening Serpens, pairs this technique with DLL sideloading, fake job lures, and staged remote access trojans to keep victims blind and defenders behind.
The group begins with highly tailored social engineering, often posing as recruiters, job portals, or meeting software to convince targets to open a malicious archive.
Once the victim runs the trusted executable, the attackers use a weaponized configuration file to hijack the .NET startup process and load attacker-controlled code from the local directory.
That step matters because it happens before the host application fully launches. In the observed samples, the malicious configuration disables ETW, bypasses strong-name validation, and blocks safer assembly redirection, which reduces the visibility that EDR products normally depend on.
ETW, or Event Tracing for Windows, is a major telemetry source used by modern security tools to monitor .NET behavior and loaded assemblies.
By switching it off through legitimate .NET configuration settings, the attackers avoid noisy memory patching or obvious API hooking that defenders might otherwise catch.
Unit 42 said in a report shared with GBhackers, evidence of cyberattacks by the Iran-nexus advanced persistent threat (APT) group Screening Serpens (aka UNC1549, Smoke Sandstorm and Iranian Dream Job).Â
The research also shows that the attackers used the hijack to run malicious DLLs in a trusted process context before the security stack had a chance to react. This gives the malware a stealthier launch path and helps it survive normal inspection workflows.
Iranian Hackers Hijack AppDomainManager
After the initial hijack, the loader drops and renames files in the user’s AppData path, then creates a scheduled task to maintain persistence. In one flow, a fake installer window is shown to the user while the malware prepares the second stage in the background.
Attackers mimicked legitimate corporate job applications by including specific job IDs, increasing the likelihood that the target will review the descriptions and extract the nested Hiring Portal.zip.
The final payload is a multi-function RAT that can execute commands, manipulate processes, upload files in chunks, and contact multiple command-and-control servers.
The campaign also uses rotating Azure-hosted domains and browser-like user agents to blend in with normal network traffic.
This campaign shows a clear shift from basic DLL sideloading to a more advanced pre-execution defense evasion model. Instead of breaking security tools directly, the attackers ask the .NET runtime to turn its own protections off through a config file, which is a cleaner and less suspicious method.
For defenders, this means detections should focus on unusual .NET configuration files, unexpected AppDomainManager settings, suspicious local assembly loading, and trusted executables launching from user-writable paths.
The threat actor uses the dropped update.exe.config file to reapply their native evasion directives, explicitly disabling ETW and strong name verification.Â
Blocking or alerting on these behaviors can help catch the attack before the RAT gains control.
Security teams should review .NET applications that load from local paths, monitor for abnormal scheduled tasks, and inspect archives that contain legitimate binaries paired with unusual DLLs.
It is also important to treat DLL sideloading and AppDomainManager hijacking as high-risk behaviors, not just signature-based malware events.
The broader lesson is simple: these actors are no longer relying only on malware payloads. They are attacking the startup logic of trusted software itself, which makes behavior-based detection and application hardening far more important than static indicators alone.
Indicators of Compromise
Domains
| # | Domain |
|---|---|
| 1 | licencemanagers.azurewebsites[.]net |
| 2 | LicenceSupporting.azurewebsites[.]net |
| 3 | PeerDistSvcManagers.azurewebsites[.]net |
| 4 | ThemesManagers.azurewebsites[.]net |
| 5 | ThemesProviderManagers.azurewebsites[.]net |
| 6 | docspace-y4cumb.onlyoffice[.]com |
| 7 | NanoMatrix.azurewebsites[.]net |
| 8 | QuantumWeave.azurewebsites[.]net |
| 9 | ElementShift.azurewebsites[.]net |
| 10 | business-startup[.]org |
| 11 | business-startup.azurewebsites[.]net |
| 12 | Businessstartup.azurewebsites[.]net |
| 13 | app[redacted][.]live |
| 14 | buisness-centeral.azurewebsites[.]net |
| 15 | buisness-centeral-transportation.azurewebsites[.]net |
| 16 | Buisness-centeral-transportation[.]com |
| 17 | docspace-twpf0e.onlyoffice[.]com |
| 18 | PremierHealthAdvisory[.]com |
| 19 | PremierHealthAdvisory.azurewebsites[.]net |
| 20 | Premier-HealthAdvisory.azurewebsites[.]net |
| 21 | Ramiltonsfinance[.]com |
| 22 | Ramiltonsfinance.azurewebsites[.]neti |
| 23 | Ramiltons-finance.azurewebsites[.]net |
URLs
| # | URL |
|---|---|
| 1 | hxxps[:]//docspace-y4cumb.onlyoffice[.]com/storage/files/root/folder_3602000/file_3601577/v1/content.zip[…] |
| 2 | hxxps[:]//app[redacted][.]live/meeting/edcdba624ddb43c2a1dcf334aa493068 |
| 3 | hxxps[:]//docspace-twpf0e.onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content.zip?filename=remote.[REDACTED].zip |
| 4 | hxxps[:]//2117.filemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
