Microsoft links NeedyMantis to network persistence

Microsoft said NeedyMantis had been used to keep access inside networks after initial compromise. It said the malware had shown up in a small number of targeted intrusions at telecommunications organisations, universities, medical non-profits, intergovernmental organisations and government contractors, with use dating back to at least October 2025.

Microsoft said it found the malware while reviewing indicators from Kaspersky's work on the DAEMON Tools supply chain attack. In that case, signed installers for DAEMON Tools Lite carried malicious code from 8 April 2026, and the developer replaced them with a clean version on 5 May. Microsoft tracks the related activity as Storm-3069 and said it had not seen NeedyMantis itself distributed through a supply chain attack.

Microsoft said the malware usually arrived as a bundle containing a legitimate programme, a malicious DLL and an encrypted archive. The programmes it cited included Poedit, curl, Vim and TightVNC, while the DLLs were made to look like components from Microsoft Office, Intel and NVIDIA; in one sample, the malicious file replaced WinSparkle.dll in Poedit.

In one case, an intruder who was already inside the network used Impacket to copy the bundle from a network share and execute it on a target machine. After loading, the DLL unpacked the next stage, which decoded the main component, connected to a command-and-control server over HTTPS and then moved to WebSocket traffic so operators could load and remove modules. Microsoft said it had not confirmed what those modules did, and it did not describe how the newer version stayed on a machine.

Microsoft assessed Storm-3069 activity as probably coming from China, but said it had not tied the group to a Chinese state actor. Google Threat Intelligence Group tracks the DAEMON Tools campaign as UNC6863, and Mandiant has described UNC6863 as a suspected China-nexus actor. Microsoft published hashes, domains, file paths and hunting queries, and said Defender detects the malware as TrojanDropper:Win64/NeedyMantis and Behavior:Win64/NeedyMantis.