cyber.hendryadrian.com
Security News · darkreading.com

Microsoft Finds NeedyMantis Backdoor Used to Maintain Access to Targeted Networks

· Original article ↗

Summary

Microsoft says NeedyMantis, a modular backdoor used in targeted intrusions since at least October 2025, gives attackers stealthy post-compromise access. It is linked to Storm-3069, though not all deployments are attributed to the group.

Key points

  • Microsoft found NeedyMantis while investigating indicators associated with the DAEMON Tools supply-chain compromise.
  • The malware has been used in a limited number of intrusions targeting telecommunications firms, universities, medical nonprofits, intergovernmental organizations, and government contractors.
  • NeedyMantis uses a two-stage loader, encrypted custom archives, and modular components to conceal payloads and extend its capabilities.
  • It can use DLL sideloading with trusted applications, including Poedit, curl, Vim, and TightVNC, and communicate over HTTPS and WebSockets.
  • Microsoft links the malware to China-based actor Storm-3069 but has not established that every deployment is associated with the group.
  • Defenders are advised to monitor behaviors such as file copying, DLL loading, and unusual network activity; Microsoft also recommends running EDR in block mode.

Article Details

Event Type
Disclosure of NeedyMantis, a modular malware family used in targeted intrusions for post-compromise access.
Impact
NeedyMantis gives attackers stealthy, potentially long-term access to compromised networks and can load additional modules. Reported targets include telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government contractors. The malware's full capabilities and the motive behind its use remain unknown.

People

Andrew CostisEngineering manager of the adversary research team at AttackIQ; commented on NeedyMantis's capabilities and potential cyber-espionage use.

Threat Actors

Salt TyphoonDescribed as a China-backed threat group that breached telecommunications providers' networks in a global spree the previous year.Storm-3069Microsoft linked NeedyMantis to this threat actor, which it said is based in China; Microsoft did not link the actor to a Chinese nation-state group and has not concluded that all NeedyMantis deployments are associated with it.

Malware

NeedyMantisThe malware, dubbed "NeedyMantis," is a modular framework that has been used in a limited number of targeted intrusions against telecommunications companies, universities, medical nonprofits, intergovernmental

Products

curlcode look legitimate. It uses DLL sideloading to hide behind trusted applications such as Poedit, curl, Vim, and TightVNC, with malicious DLLs posing as components from major software vendors, according toDAEMON Toolsdiscovered NeedyMantis while investigating indicators of compromise (IoCs) associated with the DAEMON Tools supply chain compromise, which was reported by Kaspersky in May. The malware, used since at leastPoeditmake malicious code look legitimate. It uses DLL sideloading to hide behind trusted applications such as Poedit, curl, Vim, and TightVNC, with malicious DLLs posing as components from major software vendors, accordingTightVNClegitimate. It uses DLL sideloading to hide behind trusted applications such as Poedit, curl, Vim, and TightVNC, with malicious DLLs posing as components from major software vendors, according to Microsoft.Vimcode look legitimate. It uses DLL sideloading to hide behind trusted applications such as Poedit, curl, Vim, and TightVNC, with malicious DLLs posing as components from major software vendors, according to Microsoft.

Tools

ImpacketIn one intrusion, attackers used Impacket to copy the legitimate software and malicious files before execution. "This activity occurred after the actor had already obtained access to the environment and illustrates one

Countries

ChinaThe company linked the malware to a threat actor tracked as Storm-3069 that is based in China, though Microsoft did not link the actor to any Chinese nation-state groups. However, Microsoft has not concluded that all

Industries

EducationGovernment contractingHealthcareIntergovernmental organizationstargeted intrusions against telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government contractors, Microsoft Threat Intelligence revealed in a blog post yesterday.Telecommunicationsis a modular framework that has been used in a limited number of targeted intrusions against telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government

Related Articles