Microsoft Threat Intelligence describes NeedyMantis as a multi-component, post-compromise malware framework observed since October 2025 that enables long-term network access and data exfiltration. The activity has been linked to operators from China, including one tracked as Storm-3069.
NeedyMantis is deployed after attackers gain initial access and is designed to maintain prolonged, stealthy presence within networks.
Attackers deliver the malware via DLL side-loading bundled with legitimate open-source installers (Poedit, curl, Vim, TightVNC) and fake vendor DLLs.
Microsoft links at least one operator to Storm-3069 and highlights anti-analysis features, multi-stage loaders, and C2 channels for persistence and exfiltration.
# What Microsoft found
# How NeedyMantis is used NeedyMantis is a post-compromise toolset. Microsoft's analysis indicates attackers first gain access to an environment by other means, then install NeedyMantis to keep long-term access and enable follow-on operations. The framework contains multiple components written in C++ and x64 shellcode. The malware deploys anti-analysis techniques to evade detection and hinder defensive analysis.
Delivery and deployment are hands-on. Microsoft observed operators installing components directly on compromised systems and packaging malicious files alongside legitimate software downloads to disguise activity. The installation chain frequently uses DLL side-loading as the first-stage loader.
# Delivery techniques observed
# Link to Storm-3069 and supply chain context Microsoft identified Storm-3069 as one operator associated with NeedyMantis activity. Storm-3069 has prior linkage to a supply chain compromise involving DAEMON Tools, but Microsoft did not find evidence that NeedyMantis itself was distributed via that supply chain compromise. Microsoft notes supply chain activity remains a possible means for actors to gain the necessary access to deploy the malware, but it did not confirm supply chain distribution of NeedyMantis.
# Operational impact and defender actions NeedyMantis provides attackers with persistent remote access, the ability to exfiltrate data, and to deploy additional components. The malware's anti-analysis features and use of legitimate software as a delivery vehicle increase the chance of prolonged compromise if not detected.
Microsoft published indicators and hunting queries defenders can use. The company also recommended configuration and product-level mitigations focused on rapid detection and blocking.
# Microsoft mitigation recommendations
These measures are presented as immediate controls defenders can enable within Microsoft security products to reduce the chance of successful deployment and persistence of NeedyMantis.
# Bottom line NeedyMantis is a stealthy, multi-component post-compromise framework that attackers use to remain hidden and maintain long-term access. Delivery via DLL side-loading bundled with legitimate software and use of anti-analysis techniques make detection harder. Organizations should use the published indicators and consider the listed product configurations to reduce exposure and disrupt active intrusions.
Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental or
A malicious ScreenConnect campaign in which rogue remote-access clients do more than provide attackers with hands-on control: modified clients can automatically push a multi-stage VBScript malware chain to newly connected Windows endpoints. Once deployed, the clients repeatedly spawned wscript.exe to execute four scrip
Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick
Hackers are turning rogue remote-support installations into a tool that can spread malicious code between Windows computers. The activity stands out because an infected remote-access client can pass staged payloads to connected systems, widening an intrusion without a lure for every victim. The campaign began with soci
An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based ope
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. [...]
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.