NeedyMantis: New Modular Malware Used to Keep Long-Term Access in Targeted Intrusions

Microsoft Threat Intelligence has identified a malware family called NeedyMantis, seen in a limited number of targeted operations. Victims include telecommunications organisations, universities, medical nonprofits, intergovernmental organisations and government contractors. The malware is typically deployed after an attacker has already gained access, which suggests it is used to maintain long-term access and support follow-on activity. Activity dates back to at least October 2025.

Microsoft found NeedyMantis while analysing research and indicators of compromise tied to the DAEMON Tools supply chain compromise, which Kaspersky previously reported. At least one threat actor, tracked as Storm-3069, has been seen using it. Storm-3069 is Microsoft's designator for activity associated with that compromise. Microsoft assesses the activity originates from China, but has not attributed Storm-3069 to a Chinese nation-state actor, and has not determined whether all observed activity comes from the same operator.

NeedyMantis uses techniques common in modern malware, but combines multiple loaders, custom encrypted file archives, a custom executable file format and modular components. These features help operators evade analysis and add functionality through extra modules. Microsoft's full analysis covers packaging and deployment, command-and-control communications and modular design, and provides indicators of compromise, Microsoft Defender detections and mitigation guidance.