1. Home
  2. Software
  3. MiniJunk

MiniJunk

MiniJunk is a custom malware designed for long-term persistence and remote code execution.[1] MiniJunk  was first observed in 2025 and is a modified version of the MiniBike framework that was first observed in June 2022.[1] MiniJunk has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9053
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 24 September 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

MiniJunk has leveraged HTTPS calls to the C2.[1]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

MiniJunk has been executed using the auto-run registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MigAutoPlay that executes the benign windows executable MigAutoPlay.[1]

Enterprise T1074 .001 Data Staged: Local Data Staging

MiniJunk has the ability to move or rename files.[1]
Enterprise T1083 File and Directory Discovery

MiniJunk has listed all hard drives or has listed files within a specified directory.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

MiniJunk has a command that is capable of deleting a file.[1]

Enterprise T1105 Ingress Tool Transfer

MiniJunk has the ability to load a DLL from the C2.[1]
Enterprise T1106 Native API

MiniJunk has utilized Windows API calls to make HTTPs requests to C2.[1]

Enterprise T1027 Obfuscated Files or Information

MiniJunk has obfuscated code that utilized junk code insertion, control-flow obfuscation, opaque predicates, obfuscated function calls, and encrypted strings to hinder analysis.[1]

.013 Encrypted/Encoded File

MiniJunk has encoded network data by converting strings into bytes, then reversing the bytes and the entire strings. MiniJunk has also encrypted strings to obfuscate code.[1]

.015 Compression

MiniJunk has been delivered within a malicious zip file.[1]

.016 Junk Code Insertion

MiniJunk has been compiled through several obfuscation techniques to include junk code insertion.[1]

Enterprise T1057 Process Discovery

MiniJunk has the ability to validate running processes.[1]

Enterprise T1553 .002 Subvert Trust Controls: Code Signing

MiniJunk has leveraged legitimate digital signatures from SSL[.]com to appear legitimate.[1]

Enterprise T1082 System Information Discovery

MiniJunk has the ability to gather the computer name.[1]

Enterprise T1033 System Owner/User Discovery

MiniJunk has collected the domain name with username.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

MiniJunk has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.