Iranian APT group Screening Serpens (also tracked as UNC1549 and Smoke Sandstorm) has deployed six new remote access Trojans in an active espionage campaign targeting defense, aerospace, technology, and critical infrastructure organizations in the United States, Israel, and the United Arab Emirates. The campaign uses job-themed spearphishing and cloud-based command-and-control infrastructure, consistent with this actor’s established tradecraft. Organizations in targeted sectors face elevated risk of long-term network compromise, intellectual property theft, and theft of military operational data and personnel records.