Swarmer Tool Evading EDR With a Stealthy Modification on Windows Registry for Persistence

Back Cybersecuritynews

Swarmer Tool Evading EDR With a Stealthy Modification on Windows Registry for Persistence

Cybersecuritynews • January 29, 2026

Share: View original

A critical security advisory has been released for a command injection vulnerability affecting the Archer… ... code execution (RCE)… 15 hours ago.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Swarmer Tool Enables Stealthy Registry Persistence on Windows Praetorian Inc. has released Swarmer, a tool that allows low-privilege attackers to achieve stealthy persistence in the Windows registry while evading Endpoint Detection and Response (EDR) systems. The tool exploits mandatory user profiles and the Offline Registry API to modify the NTUSER hive without triggering standard hooks, posing a risk to systems since its operational deployment in February 2025. 4 sources 18

Extracted Entities

Attack Types (1)

Command Injection

MITRE ATT&CK (1)

T1112 - Modify Registry

Platforms (1)

Tools (1)