Microsoft details NeedyMantis malware used in targeted post-compromise operations
Summary
Microsoft analyzes NeedyMantis, a modular malware family observed in targeted intrusions. It describes DLL sideloading, custom loaders and archives, WebSocket command-and-control, affected sectors, indicators, and defensive guidance.
Key points
- Microsoft says NeedyMantis has been observed since at least October 2025 in a limited number of targeted operations affecting telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors.
- The malware is typically deployed after an attacker has already gained access; one observed operator, Storm-3069, was associated with the DAEMON Tools supply chain compromise, but Microsoft has not attributed the activity to a nation-state actor.
- NeedyMantis uses DLL sideloading, often masquerading as legitimate software components, and can be copied from a network share and executed during hands-on-keyboard activity.
- Its multi-stage architecture uses custom encrypted and compressed archives, obfuscated loaders, and a custom executable format to extract and run its main component.
- The main component communicates with command-and-control over HTTPS and WebSockets and supports loading, unloading, and dispatching data to additional modules; those modules' capabilities remain unconfirmed.
- Microsoft provides indicators, Defender detections, hunting queries, and mitigation guidance, including monitoring for the identified C2 domain and enabling relevant Defender protections.
Article Details
- Attack Vectors
- NeedyMantis is typically deployed after an actor has already established access to a target environment; the methods used to gain that access may vary.
- The first-stage loader is packaged alongside legitimate software, masquerades as a required DLL, and is launched through DLL sideloading.
- In one observed incident, an operator used Impacket to copy legitimate software, the malicious DLL, and the archive from a network share to a targeted device and execute them.
- The malware uses staged loaders and encrypted, compressed archives to extract and run its components.
- NeedyMantis communicates with its C2 over HTTPS before switching to a WebSockets-based binary protocol, and can load, unload, and dispatch data to additional modules.
- Defensive Notes
- Monitor outbound network traffic for connections to corp.tripswithengine[.]com.
- Enable cloud-delivered protection, block at first sight, EDR in block mode, network protection, and automatic attack disruption.
- Consider enabling attack surface reduction rules that block executable files unless they meet prevalence, age, or trusted-list criteria and block execution of potentially obfuscated scripts.
- Hunt for NeedyMantis DLL sideloading in the listed Poedit, USOShared, VIM, TightVNC, office, broadcom, Intel, modifiable, and ics paths, and review relevant Defender detections for suspicious DLL loading, decoding, and Impacket activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | corp[.]tripswithengine[.]com | NeedyMantis C2 hostname. |
| SHA256 | 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef | SHA-256 of the NeedyMantis custom file archive WinSparkle. |
| SHA256 | c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 | SHA-256 of an older NeedyMantis custom file archive named libcurl. |
| SHA256 | e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e | SHA-256 of the NeedyMantis first-stage loader WinSparkle.dll. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware obfuscates strings and constants and uses custom encrypted, compressed archives and a custom executable format.T1057 · Process DiscoveryThe initial C2 beacon includes a process list.T1071.001 · Web ProtocolsNeedyMantis starts C2 communications with an HTTPS GET request and continues over WebSockets.T1082 · System Information DiscoveryThe initial C2 beacon includes the computer name and username.T1083 · File and Directory DiscoveryThe initial C2 beacon includes a listing of files in the ProgramFiles directory.T1105 · Ingress Tool TransferThe main component handles additional modules received from the C2 and supports loading them.T1140 · Deobfuscate/Decode Files or InformationThe loaders XOR-decode and decompress archived or embedded data to extract subsequent components.T1573.001 · Symmetric CryptographyThe C2 protocol optionally encrypts data with RC4, using a key derived from a random buffer.T1574.002 · DLL Side-LoadingThe first-stage loader masquerades as a required DLL and is loaded through DLL sideloading.
Threat Actors
Malware
Vendors
Products
7-Zip7-zip.chm – Legitimate component of 7-ZipCtrl2Capmain.dll – Legitimate Sysinternals component Ctrl2CapcurlSome of the open-source, software abused by the malware include: Poedit (translation), curl (data transfer), Vim (text editor), and TightVNC (remote access).Disk2vhdDisk2vhd.dll – Legitimate Sysinternals component Disk2vhdMicrosoft DefenderWe also provide indicators of compromise (IOCs), Microsoft Defender detections, and mitigation guidance to help organizations defend against this threat and related activity.Microsoft Defender Antivirusmalicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode.Microsoft Defender for EndpointRun Endpoint Detection and Response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft DefenderMicrosoft Defender XDRConfigure automatic attack disruption in Microsoft Defender XDR.Microsoft OfficeMicrosoft has also observed NeedyMantis masquerading as Microsoft Office, Broadcom, Intel, and NVIDIA DLL components.Microsoft Security CopilotMicrosoft Security CopilotMicrosoft SentinelMicrosoft SentinelPoeditSome of the open-source, software abused by the malware include: Poedit (translation), curl (data transfer), Vim (text editor), and TightVNC (remote access).TightVNCSome of the open-source, software abused by the malware include: Poedit (translation), curl (data transfer), Vim (text editor), and TightVNC (remote access).VimSome of the open-source, software abused by the malware include: Poedit (translation), curl (data transfer), Vim (text editor), and TightVNC (remote access).
Tools
Countries
Industries
EducationGovernment contractingHealthcareIntergovernmental organizationsoperations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors.Telecommunicationspost-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government