Storm-3069 (Threat actor): news timeline & CVEs

Microsoft Warns NeedyMantis Malware Enables Persistent Network Access

Microsoft warns China-linked NeedyMantis malware maintains persistent access in telecom, university, and government networks.

Microsoft Threat Intelligence warned on September 28 that NeedyMantis, active since at least October 2025, is a multi-component C++ and x64 shellcode framework used for long-term access after an intrusion. Campaigns have targeted telecommunications providers, universities, and government-linked organizations; Microsoft associates the activity with China and at least one operator, Storm-3069, without confirming state direction. Attackers install it through hands-on access, side-loading DLLs packaged with software such as Poedit, curl, Vim, and TightVNC or fake Microsoft, Broadcom, Intel, and NVIDIA components, then deploy a second-stage loader that contacts command-and-control for persistence, exfiltration, and additional payloads. Microsoft found no evidence it was distributed through the Daemon Tools supply-chain compromise linked to Storm-3069.

Infosecurity Magazineupdated Sep 29, 15:12 UTC · 13h agofirst Sep 29, 13:30 UTC · 15h agoMalware in the wild 7 sources

Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

Microsoft dissected NeedyMantis, a modular backdoor Storm-3069 used after the Daemon Tools supply-chain attack.

Microsoft published a technical analysis of NeedyMantis, a modular post-compromise framework linked to the May 2026 Daemon Tools supply-chain attack. Poisoned installers from the official site infected thousands of computers, and a backdoor was deployed on roughly a dozen systems at government, scientific, manufacturing, and retail organizations in Belarus, Russia, and Thailand. Storm-3069, a China-based group not attributed to a nation-state, and possibly other Chinese actors have used NeedyMantis since at least October 2025 against universities, government contractors, telecoms, and medical and intergovernmental organizations. The chain uses DLL sideloading, custom encrypted archives, a WebSockets command-and-control channel with ten control functions, and Impacket for hands-on-keyboard deployment; module capabilities remain unconfirmed.

SecurityWeekupdated Sep 29, 15:12 UTC · 13h agofirst Sep 29, 09:46 UTC · 19h agoMalware in the wild 7 sources

Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors

Microsoft details NeedyMantis, a modular post-compromise malware framework targeting telecoms, government contractors and intergovernmental organizations, linked to China-origin cluster Storm-3069.

Microsoft Threat Intelligence identified NeedyMantis, a C++ post-compromise framework with DLL sideloading via legitimate apps like Poedit, curl, Vim and TightVNC, active since at least October 2025. The malware was found while investigating the DAEMON Tools supply-chain compromise previously reported by Kaspersky, and Microsoft linked at least one user to Storm-3069, a China-origin activity cluster. C2 starts over HTTPS then switches to WebSockets, with the analyzed configuration using corp.tripswithengine[.]com on port 443 and URI /library/zip/. Victims span telecommunications, government contractors, universities, medical nonprofits and intergovernmental organizations.

GBHackersupdated Sep 29, 15:12 UTC · 13h agofirst Sep 29, 07:54 UTC · 21h agoMalware in the wild 7 sources

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Microsoft says NeedyMantis malware maintained long-term access after targeted network breaches.

Microsoft analyzed NeedyMantis, malware used since at least October 2025 to keep access in a small number of intrusions at telecommunications firms, universities, medical nonprofits, intergovernmental organizations, and government contractors. It arrives as a legitimate program, a sideloaded DLL, and an encrypted archive, then contacts a command server over HTTPS before switching to WebSocket so operators can load modules. Microsoft links some use to Storm-3069, which it assesses appears to originate in China, and associates that group with the DAEMON Tools supply-chain attack tracked by Google as UNC6863, though it has not seen NeedyMantis delivered that way. Published indicators include three SHA-256 hashes, corp.tripswithengine[.]com, and Defender detections named TrojanDropper:Win64/NeedyMantis.

The Hacker Newsupdated Sep 29, 15:12 UTC · 13h agofirst Sep 28, 18:35 UTC · 1d agoMalware in the wild 7 sources

Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks

Microsoft uncovers NeedyMantis, a modular backdoor keeping covert access in targeted telecom, university, and government networks.

Microsoft Threat Intelligence disclosed NeedyMantis, a modular post-compromise framework used to keep covert access inside already-breached networks since at least October 2025. It appeared in a small number of targeted intrusions against telecommunications providers, universities, medical nonprofits, intergovernmental bodies, and government contractors. Operators deploy it after initial access, including Impacket copies from a network share and DLL sideloading of apps such as Poedit, curl, Vim, and TightVNC. The implant beacons to corp.tripswithengine.com over HTTPS and WebSockets; Microsoft links related DAEMON Tools supply-chain activity to China-based Storm-3069 but says NeedyMantis was not delivered that way.

Cyber Security Newsupdated Sep 29, 15:12 UTC · 13h agofirst Sep 28, 16:35 UTC · 1d agoMalware in the wild 7 sources

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft details NeedyMantis, modular post-compromise malware used in targeted intrusions linked to China-based operators.

Microsoft Threat Intelligence disclosed NeedyMantis, a modular post-compromise malware family written in C++ and x64 shellcode and seen in a limited set of targeted intrusions since at least October 2025. Victims include telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. One known operator is Storm-3069, Microsoft’s designator for activity tied to the DAEMON Tools supply-chain compromise previously reported by Kaspersky; Microsoft assesses a China nexus but has not attributed the group to a nation-state or confirmed a single operator. The malware is typically deployed after access is already obtained, using DLL sideloading of legitimate software such as Poedit, curl, Vim, and TightVNC, plus masqueraded Microsoft, Broadcom, Intel, and NVIDIA DLLs.

Microsoft Security Blogupdated Sep 29, 15:12 UTC · 13h agofirst Sep 28, 15:00 UTC · 1d agoMalware in the wild 7 sources

Storm-3069

Timeline6 articles

Appears with