Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.

NeedyMantis maintains long-term access in targeted intrusions, using DLL sideloading and HTTPS-to-WebSocket command-and-control.

Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.

Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries

Groups Conversations All groups and messages Sign in Technical - Malware Conversations About Privacy • Terms     NeedyMantis: Unpacking a post-compromise malware family used in targeted operations 0 views Eyal Estrin unread, 1:19 PM (11 minutes ago)    to https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Microsoft observed a China-based actor using the modular malware in intrusions against telcos, universities, medical, and government organizations.

A fake update component for the Poedit translation app gave attackers a quiet foothold on Windows machines. According to Microsoft Threat Intelligence's new analysis of NeedyMantis, this trick is one of several used by a modular backdoor. The NeedyMantis malware has hit telecom firms, universities, medical nonprofits, intergovernmental bodies, and government contractors since at least October 2025. At a Glance…

The malware framework uses a modular architecture and a custom executable file format for long-term persistence.

Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries

Microsoft Threat Intelligenceは2026年9月28日、標的型攻撃で使用されているモ

https://www.osintinvestigate.com Microsoft has analyzed NeedyMantis, a modular malware framework linked to targeted attacks following the May 2026 Daemon Tools supply chain compromise. In this episode, we examine how NeedyMantis works, its custom loaders and file formats, DLL sideloading, WebSockets-based command-and-control, and its role in maintaining long-term access to compromised environments. We also explore what Microsoft discovered about the threat actor tracked as Storm-3069 and why the attack highlights the risks of software supply-chain compromises.

Microsoft observed a China-based actor using the modular malware in intrusions against telcos, universities, medical, and government organizations.

NeedyMantis maintains long-term access in targeted intrusions, using DLL sideloading and HTTPS-to-WebSocket command-and-control.

Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries

📅 Source : Microsoft Threat Intelligence Blog, publié le 28 septembre 2026. Cette publication présente une analyse technique approfondie de NeedyMantis, une famille de malware post-compromis modulaire découverte lors d'investigations liées à la compromission de la chaîne d'approvisionnement DAEMON Tools, précédemment rapportée par Kaspersky.

Microsoft observed a China-based actor using the modular malware in intrusions against telcos, universities, medical, and government organizations.

OpenAI has decided not to release its latest AI model due to safety concerns. Kiteworks has lifted a precautionary system shutdown. Apple has released a patch for a zero-day vulnerability that was being exploited. Japanese rail operators have reported being victims of cyberattacks. An authentication flaw in Anthropic's software could lead to account takeovers. Thousands of Supabase databases have experienced data leaks. The NeedyMantis malware has been observed targeting telecommunications companies and governments. A Vietnamese national is facing charges related to a cryptocurrency laundering scheme worth millions. James Winebrenner of Elisity discussed challenges in complying with the EU Cyber Resilience Act, particularly for manufacturers. The article also includes a reminder about careful information sharing when seeking credit and encourages listeners to engage with the CyberWire podcast.

Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Its use goes back to at least

Microsoft observed a China-based actor using a previously unidentified malware framework in targeted intrusions against telcos, universities, medical, and government-related organizations.