MiniUpdate RAT Abuses Azure C2 for Targeted Espionage

Unit42 documents a sophisticated Iran-linked APT campaign (Screening Serpens / UNC1549 / Smoke Sandstorm) deploying a new RAT family named MiniUpdate and an evolved MiniJunk V2 via targeted spear-phishing and DLL sideloading; the malware abuses .NET AppDomainManager hijacking and Azure-hosted C2s to evade EDR, maintain persistence, and exfiltrate data from organizations across the US, Israel, UAE, and other regional targets, with multiple IOCs and recommendations for defenders.