Swarmer Tool Abuses Windows Registry to Evade Detection and Persist on Systems

Gbhackers •Divya • January 29, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Swarmer Tool Enables Stealthy Registry Persistence on Windows Praetorian Inc. has released Swarmer, a tool that allows low-privilege attackers to achieve stealthy persistence in the Windows registry while evading Endpoint Detection and Response (EDR) systems. The tool exploits mandatory user profiles and the Offline Registry API to modify the NTUSER hive without triggering standard hooks, posing a risk to systems since its operational deployment in February 2025. 4 sources 18

Extracted Entities

Swarmer Tool Abuses Windows Registry to Evade Detection and Persist on Systems

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (1)