1. Home
  2. Software
  3. MiniBike

MiniBike

MiniBike is a custom backdoor written in C++ designed for command execution, data discovery, gathering, and exfiltration.[1] MiniBike has been known to communicate with the C2 using Azure Cloud Infrastructure. MiniBike was first observed in 2022.[1] MiniBike has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9059
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 28 September 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

MiniBike has leveraged HTTP calls to the C2.[1]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

MiniBike has established persistence through the creation of registry keys to include HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveFileCoAuth.exe.[1]

Enterprise T1005 Data from Local System

MiniBike has collected files from the local victim machines.[1]

Enterprise T1041 Exfiltration Over C2 Channel

MiniBike has uploaded files over the C2.[1]

Enterprise T1083 File and Directory Discovery

MiniBike has enumerated directories and files on victim machines.[1]

Enterprise T1574 .001 Hijack Execution Flow: DLL

MiniBike has been deployed using a launcher, which has been executed via search-order-hijacking (SoH).[1]
Enterprise T1105 Ingress Tool Transfer

MiniBike has the ability to download files from the C2.[1]

Enterprise T1027 .015 Obfuscated Files or Information: Compression

MiniBike has been delivered within an archive, such as a ZIP file, delivered via spearphishing.[1]
Enterprise T1082 System Information Discovery

MiniBike has collected system information from the victim machine.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

MiniBike has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.