Reported by 8 outlets
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Why this score
- Breadth
- 2.00 / 2.0 · 8 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Microsoft Threat Intelligence has documented NeedyMantis, a modular post-compromise malware family used in a small number of targeted intrusions against telecommunications firms, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activity dates back to at least October 2025. Microsoft found the family while pivoting from indicators of the DAEMON Tools supply chain compromise, the May 2026 campaign that pushed poisoned installers from the official site, infected thousands of machines, and landed a backdoor on roughly a dozen hosts in Belarus, Russia, and Thailand.
NeedyMantis is not an initial access vector. It is deployed after an actor already controls the environment, to hold long-term access and enable follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable format, and modular components for covert command and control. In one case operators used Impacket during hands-on-keyboard activity to copy a legitimate application, a malicious DLL, and an archive from a network share, then abused DLL sideloading; malicious components were packaged with Poedit, curl, and Vim. Microsoft tracks one operator as Storm-3069 and assesses the activity aligns with China-based actors, while stopping short of attributing it to a specific state-sponsored group.
The value here is the linkage: a supply chain backdoor case led to a reusable post-compromise toolkit shared across victims. Watch for additional vendors surfacing NeedyMantis samples, hunting queries and IOCs from Microsoft, and whether more DAEMON Tools victims turn out to have received the second-stage framework. Organizations in the affected sectors should review access around the October 2025 onward window.
Timeline
-
original reporting
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
malware.news · 15d ago · September 28th, 2026
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations Article Link: tildedennis: NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
-
update from securelist.com
DAEMON Tools software infected — supply chain attack ongoing since April 8, 2026
securelist.com · 162d ago · May 5th, 2026
Kaspersky's Threat Response team reported on May 5, 2026 (updated May 8) that DAEMON Tools installers distributed from the vendor's own website were trojanized starting April 8, 2026, with compromised builds of DAEMON Tools 12.5.0.2421 through 12.5.0.2434 backdooring signed binaries including DTHelper.exe, DiscSoftBusServiceLite.exe and DTShellHlp.exe. The implant contacted env-check.daemontools[.]cc, a domain registered March 27 that typosquats the legitimate daemon-tools[.]cc, and staged follow-on payloads from 38.180.107[.]76: a .NET information collector, a minimalistic RC4-encrypted shellcode backdoor, and a QUIC RAT aimed at a single Russian educational institution. Kaspersky observed several thousand infection attempts across more than 100 countries, but further-stage payloads landed on only about a dozen machines at retail, scientific, government and manufacturing organizations in Russia, Belarus and Thailand, indicating selective targeting. Following disclosure, the vendor acknowledged the issue and release 12.6.0.2445 no longer includes the malicious behavior.
-
update from microsoft.com
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
microsoft.com · 15d ago · September 28th, 2026
In this article Observed operators and targeting Malware packaging and distribution NeedyMantis architecture and capabilities Mitigation and protection guidance Hunting queries Indicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Based on observed activity, NeedyMantis is typically deployed after a threat actor has already established access to a target environment, indicating that the malware is used to maintain long-term access and support follow-on operations. NeedyMantis activity dates back to at least October 2025. We discovered the malware family while analyzing and pivoting from research and indicators of compromise associated with the DAEMON Tools supply chain compromise, which Kaspersky previously reported on as part of its investigation into the campaign. Observed activity involving NeedyMantis has thus far aligned with activity that Microsoft associates with threat actors operating from China, although Microsoft has not determined whether all observed activity is attributable to the same operator. While NeedyMantis employs techniques commonly used by modern malware, its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components that enable
-
update from www.microsoft.com
(microsoft.com) NeedyMantis: A Modular Post-Compromise Malware Framework Targeting High-Value Sectors In brief - This article describes Need
www.microsoft.com · 15d ago · September 28th, 2026
(microsoft.com) NeedyMantis: A Modular Post-Compromise Malware Framework Targeting High-Value Sectors In brief - This article describes Need
via Mastodon https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/
-
update from cyberpress.org
Microsoft Tracks NeedyMantis Post-Compromise Malware Targeting Telecoms and Government Contractors
cyberpress.org · 14d ago · September 29th, 2026
The malware deploys after attackers gain access, enabling persistent control, covert command-and-control communications , and modular follow-on activity. Microsoft Tracks NeedyMantis Post-Compromise Malware At least one operator, tracked as Storm-3069, has used the malware. Microsoft assesses the activity aligns with threat actors operating from China, but has not attributed Storm-3069 to a specific Chinese state-sponsored group or confirmed that all NeedyMantis incidents involve the same operator. NeedyMantis is not believed to be the initial access vector. Instead, operators introduce it after compromising an environment, making its delivery path flexible across incidents. In one case, attackers used the Impacket toolkit during hands-on-keyboard activity to copy a legitimate application, a malicious DLL, and an associated archive from a network share to a victim device. The malware abuses DLL sideloading by posing as a required DLL for legitimate software. Microsoft observed malicious components packaged with Poedit, curl, Vim, an
-
update from gbhackers.com
Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors
gbhackers.com · 14d ago · September 29th, 2026
Unlike typical malware that serves as an initial access point, NeedyMantis is designed to maintain an attacker’s access and support follow-on operations after an initial breach. NeedyMantis activity has […] The post Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from securityweek.com
Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft
securityweek.com · 14d ago · September 29th, 2026
Thousands of computers were infected through poisoned Daemon Tools iterations distributed through the official website, and a backdoor was deployed on roughly a dozen of them. In a fresh report, Microsoft provides a detailed analysis of NeedyMantis, the modular post-compromise malware the Daemon Tools hackers used in targeted attacks against universities, government contractors, and telecoms, as well as medical non-profit and intergovernmental organizations.
-
update from www.infosecurity-magazine.com
Cybersecurity researchers at Microsoft have warned that a stealthy new malware framework is enabling attackers to remain hidden inside compr
www.infosecurity-magazine.com · 14d ago · September 29th, 2026
Cybersecurity researchers at Microsoft have warned that a stealthy new malware framework is enabling attackers to remain hidden inside compr
via Mastodon https://www.infosecurity-magazine.com/news/microsoft-needymantis-malware/
-
update from www.infosecurity-magazine.com
A group of hackers is targeting businesses to gain long-term access to their private networks. If you use business software, make sure your
www.infosecurity-magazine.com · 14d ago · September 29th, 2026
A group of hackers is targeting businesses to gain long-term access to their private networks. If you use business software, make sure your
via Mastodon https://www.infosecurity-magazine.com/news/microsoft-needymantis-malware/