Microsoft’s Threat Intelligence team has identified NeedyMantis, a sophisticated malware framework, designed for maintaining clandestine access within networks that have already been compromised. This malware has been linked to a select number of targeted attacks on sectors including telecommunications, academia, and governmental bodies.
Targeted Sectors and Long-term Espionage
NeedyMantis has been detected in breaches involving telecommunications companies, educational institutions, and governmental organizations. The activity associated with this malware dates back to October 2025, indicating its use for prolonged espionage rather than general cybercrime.
Microsoft researchers stumbled upon NeedyMantis while analyzing indicators from the DAEMON Tools supply-chain breach, designated as Storm-3069. Although initially linked to China-based operations, Microsoft has not confirmed any specific state-sponsored group behind it.
Infection Mechanisms and Technical Details
The deployment of NeedyMantis is not directly tied to the compromised DAEMON Tools supply chain, suggesting different entry points for each target. A notable tactic includes the use of the Impacket toolkit to install malicious software alongside legitimate applications.
Operators utilize DLL sideloading to execute the malware, with legitimate applications loading malicious libraries disguised as essential components. Commonly exploited packages include Poedit, curl, and Vim, with files masquerading as well-known libraries.
Command and Control Capabilities
Once activated, NeedyMantis manages command-and-control communications and module downloads. Its configuration connects to corp.tripswithengine[.]com over port 443, exchanging system details through encoded and compressed methods.
Communication upgrades to WebSockets, employing XOR encoding and optional encryption. The malware can execute commands to manage modules and relay data, supporting persistent and adaptable network access.
Defensive Measures and Recommendations
Given its selective targeting, NeedyMantis poses a significant threat to organizations safeguarding critical infrastructure. Discovery of this malware should prompt thorough investigations into potential breaches, including credential theft and lateral movement.
Microsoft advises the implementation of various defensive strategies, such as cloud-delivered protection, network protection, and attack-surface-reduction rules to block untrusted executables. Security teams are urged to monitor for unusual connections and suspicious file activity.
Defender detections include specific alerts for TrojanDropper:Win64/NeedyMantis and associated behavior, providing crucial support for threat response teams.
