1. Home
  2. Software
  3. MiniBus

MiniBus

MiniBus is a custom backdoor used for command execution, data discovery, gathering, and exfiltration. MiniBus has utilized Azure Cloud Infrastructure and unique adversary-controlled domains for command and control. MiniBus is an updated platform to its predecessor MiniBike and was first observed in August 2023. MiniBus has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9060
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 28 September 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

MiniBus has leveraged HTTP calls to the C2.[1]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

MiniBus has created persistence through the use of autostart registry keys to include HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveCoUpdate.[1]
Enterprise T1574 .001 Hijack Execution Flow: DLL

MiniBus has been deployed using a launcher, which has been executed via search-order-hijacking (SoH).[1]
Enterprise T1105 Ingress Tool Transfer

MiniBus has the ability to download files from the C2.[1]
Enterprise T1057 Process Discovery

MiniBus has the ability to identify running processes.[1]
Enterprise T1518 .001 Software Discovery: Security Software Discovery

MiniBus has the ability to detect security applications.[1]
Enterprise T1673 Virtual Machine Discovery

MiniBus has the ability to identify processes associated with virtual machine utilities.[1]
Enterprise T1497 .001 Virtualization/Sandbox Evasion: System Checks

MiniBus has detected processes associated with Virtual Machines to avoid detection.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

MiniBus has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.