NeedyMantis Malware Framework Targeting Telecommunications and Government Entities

• •NeedyMantis is a modular malware framework used in targeted attacks since October 2025.
• •The malware is associated with the Storm-3069 group, believed to operate from China.
• •DLL sideloading is a key technique used by NeedyMantis to maintain access in compromised networks.

Microsoft has identified NeedyMantis, a modular post-compromise malware framework, used in targeted attacks against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. The malware has been active since at least October 2025 and is typically deployed after threat actors have established access to a target environment. NeedyMantis was discovered during investigations into the DAEMON Tools supply chain compromise, which involved malicious code in legitimate software installers. Microsoft tracks the group associated with this malware as Storm-3069, which is believed to operate from China but has not been definitively linked to a nation-state actor. The malware employs DLL sideloading techniques to maintain long-term access and can load additional modules via command-and-control communications. Microsoft has provided indicators of compromise (IOCs) to help organizations defend against this threat. The malware has been observed in multiple intrusions, indicating it may be used by more than one operator.