CTI · reviewed · 2026-09-29

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Full story & timeline

MITRE ATT&CK

• T1195 Supply Chain Compromise Initial Access
• T1073 DLL Side-Loading Stealth
• T1570 Lateral Tool Transfer Lateral Movement
• T1071 Application Layer Protocol Command and Control

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• env-check.daemontools domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Traffic to DAEMON Tools Backdoor Staging Server
id: 5d9a1c64-3f82-4b7e-9a15-2c6e7f0d8b31
status: experimental
description: Detects network connections to 38.180.107.76, the staging server used by the trojanized DAEMON Tools 12.5.0.2421-12.5.0.2434 implants (env-check.daemontools.cc C2) that Kaspersky tied to the NeedyMantis post-compromise framework used by Storm-3069. Server-side only — the implant never appears in host telemetry on the appliance that beacons to it.
references:
  - https://securelist.com/tr/daemon-tools-backdoor/119654/
  - https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/
author: Tia N. List
date: 2026/09/29
tags:
  - attack.t1071
  - attack.command-and-control
  - attack.t1195
  - attack.initial-access
logsource:
  category: network_connection
detection:
  selection:
    dst_ip: 38.180.107.76
  condition: selection
falsepositives:
  - Research or sandbox detonation of the DAEMON Tools implant samples reaching the staging server
  - Legitimate traffic if the hosting provider reassigns the IP after takedown
level: high

References

• https://malware.news/t/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/125945#post_1
• https://securelist.com/tr/daemon-tools-backdoor/119654/
• https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/
• https://intel.threadlinqs.com/threat/TL-2026-2733
• https://cyberpress.org/microsoft-tracks-needymantis-post-compromise-malware/