Microsoft Warns NeedyMantis Malware Enables Persistent Network Access

Cybersecurity researchers at Microsoft have warned that a stealthy new malware framework is enabling attackers to remain hidden inside compromised networks for extended periods.

Dubbed NeedyMantis, the malware operation has been active since at least October 2025.

Microsoft Threat Intelligence said in analysis, published on September 28, that the malware has been used in hacking campaigns which have targeted telecommunications providers, universities and government-linked organizations.

Microsoft attributed NeedyMantis activity as emerging from China, although the company has not gone so far as to attribute the activity to the threat actor working on behalf of the Chinese state. It could also not determine if all activity could be attributed to the same operator but at least one is Storm-3069.

Microsoft’s analysis of NeedyMantis suggested that it is only deployed after the threat actor has previously gained access to the compromised environment, therefore the malware is likely used to maintain long-term access and support follow-on operations.

While it remains unknown how the NeedyMantis attackers gain initial access, what is known, as detailed by Microsoft Threat Intelligence, is NeedyMantis is composed of multiple components written in C++ and x64 shellcode 

These two elements have been discovered packaged alongside legitimate software, which installs the malware through DLL side-loading as part of a first-stage loader.

Malware Delivered Via Open-Source Software

Some of the open-source software abused by NeedyMantis during the delivery includes Poedit, curl, Vim and TightVNC. Microsoft has also seen elements used as part of NeedyMantis attacks posing as fake Microsoft Office, Broadcom, Intel and NVIDIA DLL components.

According to Microsoft, NeedyMantis is deployed onto the already compromised system directly by the attacker, who uses their remote hands-on access to install the required components on the machine.

By packaging this activity alongside downloads of open-source software, the attackers are attempting to disguise their malicious activity. The malware also contains anti-analysis techniques to hinder detection and analysis by security software and cyber defenders.

Following this, a second-stage loader is deployed to further embed NeedyMantis into the compromised network, before the final stage sees NeedyMantis establish contact with a command and control server which provides the attacker with persistent access to the machine, as well as the ability to exfiltrate data or install additional components.

Microsoft noted that while Storm-3069, which has been associated with the with the Daemon Tools supply chain compromise, no evidence has been found of the malware being distributed in this way.

However, the company also noted, “Supply chain activity remains one possible means by which an actor could gain the access necessary to deploy the malware.”

To defend networks against the potential threat of cyber-attacks based around NeedyMantis, Microsoft has recommended the following mitigations:

• Turn on cloud-delivered protection and block at first sight to rapidly identify and block new and unknown malware variants.
• Run Endpoint Detection and Response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts
• Enable network protection in Microsoft Defender for Endpoint.
• Configure automatic attack disruption in Microsoft Defender XDR