Swarmer Tool Enables Stealthy Registry Persistence on Windows

Praetorian Inc. has released Swarmer, a tool that allows low-privilege attackers to achieve stealthy persistence in the Windows registry while evading Endpoint Detection and Response (EDR) systems. The tool exploits mandatory user profiles and the Offline Registry API to modify the NTUSER hive without triggering standard hooks, posing a risk to systems since its operational deployment in February 2025.