Swarmer Tool Abuses Windows Registry to Evade Detection and Persist on Systems

Swarmer is a technique/tool that abuses Windows mandatory user profiles and the Offline Registry Library (Offreg.dll) to build and deploy malicious NTUSER.MAN hives that override HKCU at user login, enabling stealthy persistence and evasion of EDRs and standard registry monitoring; defenders should watch for unexpected NTUSER.MAN creation, Offreg.dll usage by uncommon processes, and restrict profile directory controls.