Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft
Microsoft dissected NeedyMantis, a modular backdoor Storm-3069 used after the Daemon Tools supply-chain attack.
74
Product
Impacket
- Mentions · 7d0
- Mentions · 30d0
- All mentions11
- First seenAug 13, 2026
- Last mentionedSep 29, 2026
Timeline
11 articles · newest firstHackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft says NeedyMantis malware maintained long-term access after targeted network breaches.
73
Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks
Microsoft uncovers NeedyMantis, a modular backdoor keeping covert access in targeted telecom, university, and government networks.
76
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft details NeedyMantis, modular post-compromise malware used in targeted intrusions linked to China-based operators.
66
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.
74
Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly
Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.
35
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
76
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
78
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
82
Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.
70
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2025-31161100%9.8Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
- CVE-2026-2376096%9.3Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2023-2152959%8.8Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
- CVE-2024-170895%8.4Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2024-27199100%7.3Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
Appears with
- Microsoftvendor · 6
- Microsoftorganization · 5
- Mimikatzproduct · 4
- Storm-3069threat actor · 4
- Daemon Toolsproduct · 4
- NeedyMantismalware · 4
- Poeditproduct · 3
- Kasperskyvendor · 3
- Kasperskyorganization · 3
- US high schoolvictim · 2
- GreyNoiseorganization · 2
- Certipyproduct · 2
- DeepSeekai model · 2
- OpenAIvendor · 2
- DeepSeekvendor · 2
- Mandiantorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.