Microsoft detailed NeedyMantis, a malware family for holding a foothold in a compromised network

Microsoft Threat Intelligence published its analysis of NeedyMantis on 28 September — a modular malware family that is used after a compromise has already happened. According to Microsoft, activity linked to it can be traced back at least to October 2025, and the family has turned up in a limited number of targeted operations.

NeedyMantis is deployed not for intrusion but after it. Once access to an environment has been obtained, the family helps hold onto it for a long time and support the attackers' follow-on actions. Initial access methods can differ from case to case, and Microsoft does not reduce them to a single scenario.

Among the affected organizations, the analysis names telecommunications companies, universities, medical non-profits, intergovernmental bodies and government contractors. That selection, together with the small number of observed deployments, points to targeted rather than mass use.

How the family is built

The family is assembled from several parts: loaders, archives in a proprietary format with encryption and compression, and a proprietary executable format — a trimmed-down version of a PE file. The first loader is found packaged together with legitimate programs and disguised as a library those programs need: it is loaded through DLL sideloading when the program itself runs. The analysis mentions Poedit, curl, Vim and TightVNC, as well as spoofed names of DLLs associated with Microsoft Office, Broadcom, Intel and NVIDIA. Microsoft notes separately that it has not observed NeedyMantis itself being distributed through a supply chain, although such a scenario could provide the access needed to deploy it. The modular build makes analysis harder and allows new modules to be plugged in on command from the server.

The trail to DAEMON Tools

Microsoft came across NeedyMantis while analyzing indicators of compromise from the DAEMON Tools supply chain, which Kaspersky wrote about earlier. One of the observed groups was designated Storm-3069, and it is tied to the campaign against DAEMON Tools. Microsoft links the activity to groups operating from China, but does not claim that Storm-3069 is tied to the Chinese state, and does not venture to say that a single operator stands behind all the cases: several groups may be using the family.

Communication with the command-and-control server runs over WebSockets to the domain corp.tripswithengine[.]com, and the communication library carries a hardcoded user-agent firefox/21.0. For defense, Microsoft advises looking for outbound connections to this domain, enabling EDR in blocking mode, network protection and attack surface reduction rules, and automatic attack disruption.

Image: Coolcaesar CC BY-SA 4.0 · License

Translation editors: Соловьев В., Пеков А.