Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors

Microsoft Threat Intelligence has discovered NeedyMantis, a modular post-compromise malware framework that targets specific industries, including telecommunications firms, government contractors, universities, medical nonprofits, and intergovernmental organizations.

Unlike typical malware that serves as an initial access point, NeedyMantis is designed to maintain an attacker’s access and support follow-on operations after an initial breach.

NeedyMantis activity has been traced back to at least October 2025. Microsoft identified the malware while investigating indicators related to the DAEMON Tools supply-chain compromise, which Kaspersky previously reported.

The company has linked at least one user of this malware to Storm-3069, an activity cluster that Microsoft assesses as originating from China; however, it has not attributed the group to a specific Chinese nation-state actor.

Microsoft Tracks NeedyMantis Malware

According to Microsoft, NeedyMantis is typically introduced after attackers have established a foothold in a victim’s environment. In one incident, operators utilized the Impacket toolkit for hands-on-keyboard activity, copying legitimate software, a malicious DLL, and an accompanying archive from a network share before executing them on a target endpoint.

The malware exploits DLL sideloading by pairing a malicious first-stage loader with legitimate applications such as Poedit, curl, Vim, and TightVNC.

It also disguises itself as DLLs associated with reputable companies like Microsoft Office, Broadcom, Intel, and NVIDIA. Observed file names include WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, and nvml.dll.

In one analyzed case, the malware used a malicious WinSparkle.dll to impersonate the WinSparkle update component of the Poedit translation application. When the trusted executable runs, it sideloads the malicious DLL, which then extracts and executes the malware’s next stage.

NeedyMantis consists of C++ components, x64 shellcode, encrypted archives, and a custom minimized executable format. Its first-stage loader employs obfuscated stack strings, dynamically resolves Windows APIs, and includes anti-debugging checks based on ProcessDebugFlags and ThreadHideFromDebugger.

The loader decrypts and decompresses a custom archive, with its structure and XOR keys varying among samples.

In Microsoft’s analysis, one archive contained legitimate 7-Zip and Sysinternals components alongside malicious files disguised as Windows libraries, including dnsapi.dll, which stores configuration data, and ws2_32.dll, which facilitates WebSockets-based command-and-control communications.

A second-stage payload named encryptbase64.ps1 was not actually a PowerShell script; it contained x64 shellcode that decoded and loaded NeedyMantis’s primary component.

This main payload manages command-and-control (C2) traffic and supports the loading, unloading, and interaction with additional modules, allowing operators to expand functionality as needed. The specific capabilities of these modules have not yet been confirmed.

NeedyMantis initially communicates over HTTPS before switching to WebSockets. The analyzed configuration referenced corp.tripswithengine[.]com on port 443 and used the URI /library/zip/. Its communication component also included a hard-coded user agent string for Firefox/21.0, which serves as a useful artifact for network threat hunting.

Microsoft recommends that defenders investigate outbound traffic to the identified domain, enable cloud-delivered protection and endpoint detection and response (EDR) in block mode, activate network protection, and apply attack surface reduction rules that block suspicious or obfuscated scripts and untrusted executables.

IoC

Indicator	Type	Description	First Seen	Last Seen
e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e	SHA-256	NeedyMantis first-stage DLL loader masquerading as WinSparkle.dll	2026-05-21	2026-05-21
9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef	SHA-256	Custom encrypted NeedyMantis file archive named WinSparkle	2026-05-23	2026-05-23
c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77	SHA-256	Older NeedyMantis custom archive named libcurl	2025-10-03	2025-10-03
corp.tripswithengine[.]com	Domain / C2 host	NeedyMantis command-and-control infrastructure, configured for HTTPS port 443	N/A	N/A
/library/zip/	URI path	C2 URI identified in the analyzed NeedyMantis configuration	N/A	N/A
Firefox/21.0	User-Agent	Hard-coded user-agent used by the NeedyMantis WebSockets communications DLL	N/A	N/A
WinSparkle.dll	Filename	Malicious first-stage loader impersonating the WinSparkle update component	N/A	N/A
WinSparkle	Filename	Encrypted custom archive deployed alongside the malicious WinSparkle.dll loader	N/A	N/A
libcurl.dll	Filename	DLL name used by NeedyMantis to masquerade as a legitimate curl component	N/A	N/A
vim64.dll	Filename	DLL filename used in NeedyMantis DLL sideloading chains involving Vim or TightVNC directories	N/A	N/A
dbghelp.dll	Filename	Masqueraded DLL observed in fake Office and Broadcom application paths	N/A	N/A
jli.dll	Filename	Masqueraded DLL observed in a fake Intel application path	N/A	N/A
nvml.dll	Filename	Masqueraded DLL observed in fake NVIDIA-related application paths	N/A	N/A
encryptbase64.ps1	Filename	Second-stage x64 shellcode loader disguised as a PowerShell script	N/A	N/A
dnsapi.dll	Filename	Spoofed Windows DLL filename used to store NeedyMantis configuration data	N/A	N/A
ws2_32.dll	Filename	Spoofed Windows networking DLL filename used for WebSockets-based C2 communications	N/A	N/A

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC