[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF5z_sz9IuGxaLKCYAUnMGjiEWjc2DTIgrFG9R37YjdU":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5b492120-abf5-4582-8d30-3618c805cc15","Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft","daemon-tools-hackers-needymantis-malware-dissected-by-microsoft-4da022","The malware framework uses a modular architecture and a custom executable file format for long-term persistence. The post Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft appeared first on SecurityWeek.","Microsoft has detailed NeedyMantis, a modular post-compromise malware framework used by a China-based threat actor, Storm-3069. This framework was discovered following the May 2026 Daemon Tools supply chain attack, which infected thousands of computers. NeedyMantis is designed for long-term persistence and supports follow-on operations, utilizing a custom executable file format and DLL sideloading for evasion.","Microsoft analyzes NeedyMantis malware used by China-linked hackers after Daemon Tools supply chain attack.","https:\u002F\u002Fwww.securityweek.com\u002Fdaemon-tools-hackers-needymantis-malware-dissected-by-microsoft\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Fmalware-infection.webp","2026-09-29T09:46:13+00:00","2026-09-29T10:00:24.520493+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"Daemon Tools","product",{"name":21,"type":22},"Storm-3069","threat_actor",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":28},"DLL sideloading","technology",{"name":30,"type":28},"WebSockets","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":35,"value":56,"context":57},"NeedyMantis","Modular post-compromise malware framework.",[24,18],{"controls":60,"vendors":139},[61,87,115],{"slug":62,"name":63,"problem":64,"products":65},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":83,"product_name":84,"url":85,"description":86},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":109,"vendor_name":24,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,126,134],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[140],{"slug":109,"name":24,"logo_path":110,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":160},"needymantis-malware-exploits-daemon-tools-supply-chain-compromise","NeedyMantis Malware Exploits Daemon Tools Supply Chain Compromise","The Daemon Tools supply chain attack, attributed to China-based threat actor Storm-3069, demonstrates how a single compromised software distribution channel can expose thousands of endpoints to sophisticated post-compromise malware. NeedyMantis leverages DLL sideloading and a custom executable format to evade traditional detection mechanisms, enabling long-term, stealthy persistence on infected systems. This attack illustrates that even trusted, widely-used software packages can become weaponized vectors when supply chain integrity is not continuously verified. The modular design of NeedyMantis makes it particularly dangerous, as it supports layered follow-on operations that are difficult to fully eradicate once established. Organizations that lack robust software supply chain vetting and behavioral monitoring are especially vulnerable to this class of threat.",[148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-161 – Supply Chain Risk Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SA-12 – Supply Chain Protection","NIST SP 800-53 AU-6 – Audit Record Review and Analysis","MITRE ATT&CK T1574.002 – DLL Side-Loading","MITRE ATT&CK T1195.002 – Compromise Software Supply Chain","NIST CSF DE.CM-1 – Network Monitoring","ISO\u002FIEC 27001 Annex A 8.30 – Outsourced Development",{}]