In short: Microsoft Threat Intelligence has documented NeedyMantis, a previously unknown modular backdoor used after attackers already have a foothold, to keep quiet, long-term access to victim networks. Microsoft ties at least one campaign to Storm-3069, a China-based actor, and says the malware has been in use since at least October 2025 against telecoms, universities, medical nonprofits, intergovernmental organizations and government contractors.
What is NeedyMantis?
NeedyMantis is a multi-component malware framework written in C++ and x64 shellcode. It is not an initial-access tool: operators deploy it by hand once they are inside, then use it to keep access and run follow-on operations. Microsoft found it while investigating indicators linked to the DAEMON Tools supply chain compromise reported by Kaspersky in May 2026, although Microsoft says it has no evidence NeedyMantis was distributed through that compromise.
The framework is built around:
- Multiple loaders, including a two-stage loader that relies on DLL side-loading
- Custom encrypted archives and a custom executable file format
- Modular plugins that can extend its capabilities after deployment
- Command-and-control (C2) over HTTPS and WebSockets
How the infection chain works
- Prior access. How attackers first get in is still unknown. Microsoft notes supply chain activity is one possible route.
- Staging files. In one intrusion, operators used Impacket to copy a legitimate application together with malicious files to the target host.
- DLL side-loading. The legitimate program (examples include Poedit, curl, Vim and TightVNC) loads a malicious DLL placed next to it. Fake DLLs have been made to look like components from Microsoft Office, Broadcom, Intel and NVIDIA.
- Unpacking. The loader peels away layers of encrypted and compressed payloads, rotating encryption keys to frustrate static analysis.
- C2 and modules. The final stage connects to attacker infrastructure, giving persistent access, data exfiltration and the ability to load more components.
Attribution: what we know and what we don’t
Microsoft links the activity to China but has not attributed it to a Chinese state-sponsored group, and it cannot confirm that every NeedyMantis deployment comes from the same operator. No motive was stated; researchers outside Microsoft consider espionage the most likely goal given the victim profile. The capabilities of some plugins are still unconfirmed, so the public picture is probably incomplete.
Detection ideas for SOC teams
Because the malware hides behind trusted software, hunting on behavior works better than hunting on file hashes:
- Side-loading: alert when well-known tools such as
curl.exe,vim.exe, Poedit or TightVNC load DLLs from user-writable or unusual directories. Sysmon Event ID 7 (Image loaded) is a good data source. - Mismatched DLL metadata: flag DLLs claiming to be from Microsoft, Intel, NVIDIA or Broadcom that are unsigned or signed by someone else.
- Lateral file staging: watch for remote file copies over SMB admin shares (for example
ADMIN$orC$) followed by execution, a pattern typical of Impacket use. See our Impacket guide to understand what this activity looks like from the attacker’s side. - Network: look for long-lived WebSocket or HTTPS sessions from processes that normally never talk to the internet.
Microsoft’s recommendations
- Turn on cloud-delivered protection with block at first sight.
- Run EDR in block mode so post-breach artifacts can be remediated even when antivirus misses them.
- Enable network protection in Microsoft Defender for Endpoint.
- Configure automatic attack disruption in Microsoft Defender XDR.
Key takeaway
NeedyMantis is a reminder that the most dangerous phase of an intrusion is often after initial access. Detecting abuse of legitimate binaries, unusual DLL loads and admin-share file copies gives defenders a chance to catch this kind of implant even when the payload itself is unknown.