NeedyMantis Uses DLL Sideloading to Maintain Access in Breached Networks
Summary
Microsoft describes NeedyMantis intrusions affecting organizations across several sectors, detailing DLL sideloading, malware behavior and indicators. Links to Storm-3069 and the DAEMON Tools incident remain uncertain.
Key points
- Microsoft says NeedyMantis has been used in targeted intrusions since at least October 2025 to maintain access to already breached networks.
- Reported targets include telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors.
- The malware is delivered with a legitimate program, a malicious DLL and an encrypted archive; observed host programs include Poedit, curl, Vim and TightVNC.
- In one intrusion, an operator already inside the network used Impacket to copy and run the bundle. The initial access method may vary.
- The malware’s main component connects to a C2 server over HTTPS, then switches to WebSocket; Microsoft has not confirmed the functions of additional modules.
- Microsoft links some activity to Storm-3069 but says multiple groups may use NeedyMantis and has not established whether Storm-3069 and UNC6863 are the same group.
- Microsoft published hashes, file paths, hunting queries and the C2 domain corp[.]tripswithengine[.]com. It cautions that a Poedit path match alone does not prove infection.
Article Details
- Attack Vectors
- NeedyMantis was delivered as a bundle containing a legitimate program, a malicious DLL named for a file the program loads, and an encrypted archive; launching the program loaded the DLL through DLL sideloading.
- In one intrusion, an operator with existing network access used Impacket to copy the bundle from a network share and run it on a target machine.
- The malware's main component connected to a C2 server over HTTPS and then switched to a WebSocket connection.
- Defensive Notes
- Microsoft recommends enabling cloud-delivered protection, block at first sight, EDR in block mode, network protection, automatic attack disruption, and two attack surface reduction rules.
- Check outbound traffic for connections to the reported C2 domain. Microsoft also published Defender XDR and Microsoft Sentinel hunting queries, but they look back only seven days.
- A hit on the Poedit WinSparkle.dll path alone does not establish infection; compare the file with Microsoft's published hash.
- For DAEMON Tools Lite 12.5.1 downloaded or installed during the affected period, the developer advises uninstalling it, running a full system scan, and obtaining version 12.6 from the official website.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | corp[.]tripswithengine[.]com | C2 server used by NeedyMantis, communicating over port 443. |
| SHA256 | 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef | Microsoft-reported hash of an encrypted NeedyMantis archive named WinSparkle. |
| SHA256 | c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 | Microsoft-reported hash of an encrypted archive named libcurl associated with an older NeedyMantis version. |
| SHA256 | e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e | Microsoft-reported hash of the NeedyMantis first-stage loader WinSparkle.dll. |
MITRE ATT&CK
T1071.001 · Web ProtocolsThe malware's main component connects to its C2 server over HTTPS.T1102 · Web ServiceAfter the HTTPS connection, the malware switches to a WebSocket connection to the C2 server.T1140 · Deobfuscate/Decode Files or InformationThe DLL unpacks a next stage from an encrypted archive, and that stage decodes the malware's main component.T1543.003 · Windows ServiceAn older NeedyMantis version included a persistence module that used Windows services.T1574.002 · DLL Side-LoadingNeedyMantis is loaded when a legitimate program loads a malicious DLL matching a file it expects, described as DLL sideloading.
Threat Actors
Storm-3069Microsoft's temporary name for one group using NeedyMantis; Microsoft says the activity appears to originate in China but has not tied the group to a Chinese nation-state actor.UNC6863Google Threat Intelligence Group tracks the actor behind the DAEMON Tools campaign by this name; whether it is the same group as Storm-3069 is unclear.
Malware
Vendors
GoogleGoogle Threat Intelligence Group tracks the actor behind the DAEMON Tools campaign as UNC6863.KasperskyMicrosoft found NeedyMantis while following up on indicators from Kaspersky’s investigation into the supply chain attack on DAEMON Tools.MandiantIn June, Mandiant described UNC6863 as “a suspected China-nexus actor” that used the DAEMON Tools compromise to deploy malware.MicrosoftMicrosoft says the NeedyMantis malware family has been used in targeted intrusions to maintain long-term access inside already breached networks across sectors such as telecommunications, universities, and government
Products
curlThe malware abuses DLL sideloading with legitimate tools like Poedit, curl, Vim, and TightVNC.DAEMON Tools LiteIn that attack, official, signed installers for the DAEMON Tools Lite disk image program carried malicious code from April 8, 2026.Microsoft Defender AntivirusMicrosoft Defender Antivirus detects the malware as TrojanDropper:Win64/NeedyMantis and Behavior:Win64/NeedyMantis.Microsoft Defender XDRMicrosoft also published hunting queries that look for these paths in Defender XDR, and for the C2 domain and user agent in both Defender XDR and Microsoft Sentinel.Microsoft SentinelMicrosoft also published hunting queries that look for these paths in Defender XDR, and for the C2 domain and user agent in both Defender XDR and Microsoft Sentinel.PoeditThe malware abuses DLL sideloading with legitimate tools like Poedit, curl, Vim, and TightVNC.TightVNCThe malware abuses DLL sideloading with legitimate tools like Poedit, curl, Vim, and TightVNC.VimThe malware abuses DLL sideloading with legitimate tools like Poedit, curl, Vim, and TightVNC.