Threat Intelligence / Actor / Screening Serpens

Screening Serpens

As of 2026-07-28, Screening Serpens is a Iran-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning apt. Also known as Screening Serpens (UNC1549), UNC1549, Smoke Sandstorm, Iranian Dream Job.

Nation: Iran · 1 tracked threat(s) · Categories: APT

Also known as: Screening Serpens (UNC1549), UNC1549, Smoke Sandstorm, Iranian Dream Job, Nimbus Manticore

Tracked threats

Screening Serpens (UNC1549) 2026 Espionage Campaign — Six New RATs (MiniUpdate & MiniJunk V2) via AppDomainManager Hijacking — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence