NeedyMantis (Organization): news timeline & CVEs

'NeedyMantis' Provides Long-Term Access to Compromised Networks

Microsoft details NeedyMantis, a previously unseen China-linked malware framework granting long-term access in telco, university, medical, and government intrusions.

Microsoft observed a China-based threat actor deploying a previously unidentified malware framework dubbed NeedyMantis in targeted intrusions. The framework is used to maintain long-term access to compromised networks. Victims include telecommunications providers, universities, medical organizations, and government-related entities.

Dark ReadingSep 29, 15:12 UTC · 15h agoMalware in the wild 7 sources

Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors

Microsoft details NeedyMantis, a modular post-compromise malware framework targeting telecoms, government contractors and intergovernmental organizations, linked to China-origin cluster Storm-3069.

Microsoft Threat Intelligence identified NeedyMantis, a C++ post-compromise framework with DLL sideloading via legitimate apps like Poedit, curl, Vim and TightVNC, active since at least October 2025. The malware was found while investigating the DAEMON Tools supply-chain compromise previously reported by Kaspersky, and Microsoft linked at least one user to Storm-3069, a China-origin activity cluster. C2 starts over HTTPS then switches to WebSockets, with the analyzed configuration using corp.tripswithengine[.]com on port 443 and URI /library/zip/. Victims span telecommunications, government contractors, universities, medical nonprofits and intergovernmental organizations.

GBHackersupdated Sep 29, 15:12 UTC · 15h agofirst Sep 29, 07:54 UTC · 22h agoMalware in the wild 7 sources

NeedyMantis

Timeline2 articles

Appears with

'NeedyMantis' Provides Long-Term Access to Compromised Networks

Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors