Nimbus Manticore - Signed Binary Migration for Sideloading

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects a legitimate, signed Microsoft binary being programmatically copied out of System32 into C:\Users\Public via cmd.exe to prepare the DLL sideloading staging ground. This activity is associated with the Nimbus Manticore threat actor.