[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flwrcakD__HJ44p87cBLvS9DpyHJs__uvhpZw0S6rIg8":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"f176de35-135c-4df1-868a-8a3d2b6060c7","NeedyMantis: Unpacking a post-compromise malware family used in targeted operations","needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operatio-5b695e","Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations. The post NeedyMantis: Unpacking a post-compromise malware family used in targeted operations appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence discovered NeedyMantis, a modular post-compromise malware framework deployed in targeted intrusions against telecommunications, universities, medical nonprofits, and government entities. The malware, associated with threat actor Storm-3069 and the DAEMON Tools supply chain compromise, uses custom loaders, encrypted archives, and extensible components to maintain long-term access. Activity dates back to at least October 2025 and aligns with China-based threat actor operations.","Microsoft identifies NeedyMantis, modular post-compromise malware tied to China-based threat actors in targeted","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F28\u002Fneedymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FNeedyMantis-featured-image-1.png","2026-09-28T15:00:00+00:00","2026-09-28T18:00:08.094919+00:00",9,[17,20,23,26],{"name":18,"type":19},"Storm-3069","threat_actor",{"name":21,"type":22},"DAEMON Tools supply chain compromise","campaign",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":25},"Kaspersky","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":32,"value":51,"context":52},"NeedyMantis","Modular post-compromise malware framework used in targeted intrusions by China-based threat actors",[24,27],{"controls":55,"vendors":139},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":86,"name":87,"problem":88,"products":89},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":48,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,131],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":127,"product_name":128,"url":129,"description":130},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[140],{"slug":141,"name":24,"logo_path":142,"roles":143},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":162},"needymantis-malware-exploits-supply-chain-foothold-for-long-term-espionage","NeedyMantis Malware Exploits Supply Chain Foothold for Long-Term Espionage","The NeedyMantis campaign demonstrates how a single supply chain compromise — in this case via DAEMON Tools — can serve as a persistent entry point for a sophisticated, modular malware framework targeting high-value sectors like telecom, healthcare, and government. Threat actor Storm-3069 leveraged encrypted archives and extensible components to maintain stealthy, long-term access, making detection exceptionally difficult without robust endpoint and network telemetry. The use of custom loaders and modular architecture allows attackers to adapt their tooling rapidly, evading signature-based defenses. This matters because post-compromise persistence in critical sectors poses severe risks to national security, sensitive research, and citizen data.",[150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST CSF ID.SC-2: Supply Chain Risk Management","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST IR-4: Incident Handling","NIST SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1195.002: Supply Chain Compromise — Compromise Software Supply Chain","MITRE ATT&CK T1027: Obfuscated Files or Information","MITRE ATT&CK T1071: Application Layer Protocol (C2)","NIST AC-6: Least Privilege","ISO\u002FIEC 27036: Information Security for Supplier Relationships",{}]