NeedyMantis (Malware): news timeline & CVEs

Microsoft Warns NeedyMantis Malware Enables Persistent Network Access

Microsoft warns China-linked NeedyMantis malware maintains persistent access in telecom, university, and government networks.

Microsoft Threat Intelligence warned on September 28 that NeedyMantis, active since at least October 2025, is a multi-component C++ and x64 shellcode framework used for long-term access after an intrusion. Campaigns have targeted telecommunications providers, universities, and government-linked organizations; Microsoft associates the activity with China and at least one operator, Storm-3069, without confirming state direction. Attackers install it through hands-on access, side-loading DLLs packaged with software such as Poedit, curl, Vim, and TightVNC or fake Microsoft, Broadcom, Intel, and NVIDIA components, then deploy a second-stage loader that contacts command-and-control for persistence, exfiltration, and additional payloads. Microsoft found no evidence it was distributed through the Daemon Tools supply-chain compromise linked to Storm-3069.

Infosecurity Magazineupdated Sep 29, 15:12 UTC · 13h agofirst Sep 29, 13:30 UTC · 15h agoMalware in the wild 7 sources

Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

Microsoft dissected NeedyMantis, a modular backdoor Storm-3069 used after the Daemon Tools supply-chain attack.

Microsoft published a technical analysis of NeedyMantis, a modular post-compromise framework linked to the May 2026 Daemon Tools supply-chain attack. Poisoned installers from the official site infected thousands of computers, and a backdoor was deployed on roughly a dozen systems at government, scientific, manufacturing, and retail organizations in Belarus, Russia, and Thailand. Storm-3069, a China-based group not attributed to a nation-state, and possibly other Chinese actors have used NeedyMantis since at least October 2025 against universities, government contractors, telecoms, and medical and intergovernmental organizations. The chain uses DLL sideloading, custom encrypted archives, a WebSockets command-and-control channel with ten control functions, and Impacket for hands-on-keyboard deployment; module capabilities remain unconfirmed.

SecurityWeekupdated Sep 29, 15:12 UTC · 13h agofirst Sep 29, 09:46 UTC · 19h agoMalware in the wild 7 sources

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Microsoft says NeedyMantis malware maintained long-term access after targeted network breaches.

Microsoft analyzed NeedyMantis, malware used since at least October 2025 to keep access in a small number of intrusions at telecommunications firms, universities, medical nonprofits, intergovernmental organizations, and government contractors. It arrives as a legitimate program, a sideloaded DLL, and an encrypted archive, then contacts a command server over HTTPS before switching to WebSocket so operators can load modules. Microsoft links some use to Storm-3069, which it assesses appears to originate in China, and associates that group with the DAEMON Tools supply-chain attack tracked by Google as UNC6863, though it has not seen NeedyMantis delivered that way. Published indicators include three SHA-256 hashes, corp.tripswithengine[.]com, and Defender detections named TrojanDropper:Win64/NeedyMantis.

The Hacker Newsupdated Sep 29, 15:12 UTC · 13h agofirst Sep 28, 18:35 UTC · 1d agoMalware in the wild 7 sources

Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks

Microsoft uncovers NeedyMantis, a modular backdoor keeping covert access in targeted telecom, university, and government networks.

Microsoft Threat Intelligence disclosed NeedyMantis, a modular post-compromise framework used to keep covert access inside already-breached networks since at least October 2025. It appeared in a small number of targeted intrusions against telecommunications providers, universities, medical nonprofits, intergovernmental bodies, and government contractors. Operators deploy it after initial access, including Impacket copies from a network share and DLL sideloading of apps such as Poedit, curl, Vim, and TightVNC. The implant beacons to corp.tripswithengine.com over HTTPS and WebSockets; Microsoft links related DAEMON Tools supply-chain activity to China-based Storm-3069 but says NeedyMantis was not delivered that way.

Cyber Security Newsupdated Sep 29, 15:12 UTC · 13h agofirst Sep 28, 16:35 UTC · 1d agoMalware in the wild 7 sources

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft details NeedyMantis, modular post-compromise malware used in targeted intrusions linked to China-based operators.

Microsoft Threat Intelligence disclosed NeedyMantis, a modular post-compromise malware family written in C++ and x64 shellcode and seen in a limited set of targeted intrusions since at least October 2025. Victims include telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. One known operator is Storm-3069, Microsoft’s designator for activity tied to the DAEMON Tools supply-chain compromise previously reported by Kaspersky; Microsoft assesses a China nexus but has not attributed the group to a nation-state or confirmed a single operator. The malware is typically deployed after access is already obtained, using DLL sideloading of legitimate software such as Poedit, curl, Vim, and TightVNC, plus masqueraded Microsoft, Broadcom, Intel, and NVIDIA DLLs.

Microsoft Security Blogupdated Sep 29, 15:12 UTC · 13h agofirst Sep 28, 15:00 UTC · 1d agoMalware in the wild 7 sources

NeedyMantis

Timeline5 articles

Appears with

Microsoft Warns NeedyMantis Malware Enables Persistent Network Access

Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations