Microsoft Warns NeedyMantis Malware Enables Persistent Network Access

Cybersecurity researchers at Microsoft have warned that a stealthy new malware framework is enabling attackers to remain hidden inside compromised networks for extended periods.

Dubbed NeedyMantis, the malware operation has been active since at least October 2025.

Microsoft Threat Intelligence said in analysis, published on September 28 , that the malware has been used in hacking campaigns which have targeted telecommunications providers, universities and government-linked organizations.

Microsoft attributed NeedyMantis activity as emerging from China, although the company has not gone so far as to attribute the activity to the threat actor working on behalf of the Chinese state . It could also not determine if all activity could be attributed to the same operator but at least one is Storm-3069.

Microsoft’s analysis of NeedyMantis suggested that it is only deployed after the threat actor has previously gained access to the compromised environment, therefore the malware is likely used to maintain long-term access and support follow-on operations.

While it remains unknown how the NeedyMantis attackers gain initial access, what is known, as detailed by Microsoft Threat Intelligence, is NeedyMantis is composed of multiple components written in C++ and x64 shellcode

These two elements have been discovered packaged alongside legitimate software, which installs the malware through DLL side-loading as part of a first-stage loader.

Malware Delivered Via Open-Source Software

Some of the open-source software abused by NeedyMantis during the delivery includes Poedit, curl, Vim and TightVNC. Microsoft has also seen elements used as part of NeedyMantis attacks posing as fake Microsoft Office, Broadcom, Intel and NVIDIA DLL components.

According to Microsoft, NeedyMantis is deployed onto the already compromised system directly by the attacker, who uses their remote hands-on access to install the required components on the machine.

Following this, a second-stage loader is deployed to further embed NeedyMantis into the compromised network, before the final stage sees NeedyMantis establish with a command and control server which provides the attacker with persistent access to the machine, as well as the ability to exfiltrate data or install additional components.

Microsoft noted that while Storm-3069, which has been associated with the with the Daemon Tools supply chain compromise , no evidence has been found of the malware being distributed in this way.

However, the company also noted, “Supply chain activity remains one possible means by which an actor could gain the access necessary to deploy the malware.”

To defend networks against the potential threat of cyber-attacks based around NeedyMantis, Microsoft has recommended the following mitigations:

Turn on cloud-delivered protection and block at first sight to rapidly identify and block new and unknown malware variants.

Run Endpoint Detection and Response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts

Enable network protection in Microsoft Defender for Endpoint.

Configure automatic attack disruption in Microsoft Defender XDR

Microsoft, OpenAI Confirm Nation-States are Weaponizing Generative AI in Cyber-Attacks News 15 February 2024

Microsoft, OpenAI Confirm Nation-States are Weaponizing Generative AI in Cyber-Attacks

Russian and North Korean Groups Still Targeting #COVID19 Vaccine Firms News 16 November 2020

Russian and North Korean Groups Still Targeting #COVID19 Vaccine Firms

With an eye to piracy, Microsoft will not sell physical copies of Windows 8 in China News 24 October 2012

With an eye to piracy, Microsoft will not sell physical copies of Windows 8 in China

Microsoft: Pre-installed malware not from factory lines News 19 September 2012

Microsoft: Pre-installed malware not from factory lines

Pre-installed malware in production lines spurs Microsoft's 3322.org takedown News 14 September 2012

Pre-installed malware in production lines spurs Microsoft's 3322.org takedown

What’s Hot on Infosecurity Magazine?

Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk

Citrix Patches Critical Zero Days Under Active Exploitation

Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims

RemControl Banking Trojan Gives Attackers Remote Control of Android Devices

UK Government Shifts to Service-Led Cyber Governance After Stinging Audit

Researchers Identify AliExpress Phishing Domains Before Registration

Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records

ShinyHunters Claim Hack of Rival Ransomware Gang Clop

US: Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules

ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

UK Government Shifts to Service-Led Cyber Governance After Stinging Audit

AI-Driven Cloud Threats and Defenses: Securing AI-Powered Environments

Your Security Awareness Programme Isn't Failing, It's Just Not Relevant

From APIs to Agents: How to Secure AI at Enterprise Scale

Frontier AI: How Cyber Defenders Can Harness the Defender’s Window

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

How To Enhance Security Operations with AI-Powered Defenses

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust