NeedyMantis Malware Discovered in Targeted Operations

• •NeedyMantis is a modular malware family used in targeted operations.
• •Microsoft linked NeedyMantis to the DAEMON Tools supply chain compromise.
• •The malware is associated with Chinese threat actors, particularly Storm-3069.

Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family, used in targeted operations against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. The malware has been active since at least October 2025 and is typically deployed after threat actors gain initial access to a network. Microsoft linked NeedyMantis to the DAEMON Tools supply chain compromise but clarified that it has not been spread through this method. The malware is associated with threat actors operating from China, specifically a group designated as Storm-3069, though not all activity can be attributed to a single actor. NeedyMantis utilizes sophisticated techniques such as DLL sideloading and modular components to evade detection and maintain long-term access. Microsoft has provided indicators of compromise (IOCs) and mitigation guidance to help organizations defend against this threat.