NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft identifies NeedyMantis, modular post-compromise malware tied to China-based threat actors in targeted
Microsoft Threat Intelligence discovered NeedyMantis, a modular post-compromise malware framework deployed in targeted intrusions against telecommunications, universities, medical nonprofits, and government entities. The malware, associated with threat actor Storm-3069 and the DAEMON Tools supply chain compromise, uses custom loaders, encrypted archives, and extensible components to maintain long-term access. Activity dates back to at least October 2025 and aligns with China-based threat actor operations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe NeedyMantis campaign demonstrates how a single supply chain compromise — in this case via DAEMON Tools — can serve as a persistent entry point for a sophisticated, modular malware framework targeting high-value sectors like telecom, healthcare, and government. Threat actor Storm-3069 leveraged encrypted archives and extensible components to maintain stealthy, long-term access, making detection exceptionally difficult without robust endpoint and network telemetry. The use of custom loaders and modular architecture allows attackers to adapt their tooling rapidly, evading signature-based defenses. This matters because post-compromise persistence in critical sectors poses severe risks to national security, sensitive research, and citizen data.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — NeedyMantis