CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Storm-3069

actor · actor:storm-3069 single-source

Microsoft's designator for the activity behind the DAEMON Tools supply-chain compromise and at least one operator of NeedyMantis; Microsoft assesses the activity originates from China but has not attributed it to a Chinese nation-state actor (Microsoft Threat Intelligence, 2026-09-28).

Coverage
1
first 2026-10-11 → last 2026-10-11
Latest activity
2026-10-11
Microsoft: a China-aligned implant hides in legitimate software via DLL sideloading and takes modules over…
Peak priority
notable
1 notable
Targets
telco
sectors: telco, education, public-sector
Sources cited
1
1 hosts

Defender insights

What each entry about Storm-3069 tells a defender to do, newest first.

2026-10-11NOTABLEMicrosoft: a China-aligned implant hides in legitimate software via DLL sideloading and takes modules over WebSockets

Triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

attributed activity

Story timeline

  1. 2026-10-11NeedyMantis: Microsoft details a modular post-compromise framework, found through the DAEMON Tools compromise, used against telecoms, universities, intergovernmental bodies and government contractors
    active-threatsMicrosoft: a China-aligned implant hides in legitimate software via DLL sideloading and takes modules over WebSockets

Hunting pivots

Tags
china-nexus
ATT&CK techniques (10 across 5 tactics)

10 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • ExecutionHijack Execution Flow: DLL
  • StealthObfuscated Files or Information · Masquerading: Match Legitimate Resource Name or Location · Hijack Execution Flow: DLL · Debugger Evasion
  • DiscoveryProcess Discovery · System Information Discovery · File and Directory Discovery · Debugger Evasion
  • Lateral MovementLateral Tool Transfer
  • Command and ControlApplication Layer Protocol: Web Protocols · Encrypted Channel: Symmetric Cryptography

Execution TA0002

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

Discovery TA0007

T1057Process Discovery×1

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1082System Information Discovery×1

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1083File and Directory Discovery×1

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

Lateral Movement TA0008

T1570Lateral Tool Transfer×1

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

T1573.001Encrypted Channel: Symmetric Cryptography×1

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Evidence: 2026-10-11/needymantis-modular-post-compromise-framework-storm-3069 · ATT&CK page ↗

Entries about Storm-3069 (1)

2026-10-11 · view entry permalink →

NOTABLENATOB2

NeedyMantis: Microsoft details a modular post-compromise framework, found through the DAEMON Tools compromise, used against telecoms, universities, intergovernmental bodies and government contractors

Microsoft Threat Intelligence published its analysis of NeedyMantis on 2026-09-28: a modular post-compromise malware family seen since at least October 2025 in a limited number of targeted operations against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors (Microsoft Threat Intelligence, 2026-09-28). Microsoft found it by pivoting from indicators in Kaspersky's investigation of the DAEMON Tools supply-chain compromise and names Storm-3069, its designator for that activity, as at least one operator; it has seen further NeedyMantis activity beyond Storm-3069 that aligns with activity it associates with China-based actors, has not determined whether one actor is behind all of it, and assesses that Storm-3069's activity originates from China without attributing it to a Chinese nation-state actor (Microsoft Threat Intelligence, 2026-09-28). Microsoft has not seen NeedyMantis itself delivered through a supply chain; it is deployed after the operator already has access, and in one intrusion the operator used Impacket to copy the legitimate application, the malicious DLL and an encrypted archive from a network share and run them (Microsoft Threat Intelligence, 2026-09-28).

The first-stage loader is a DLL sideloaded by the legitimate program it ships with, in the analysed case a fake WinSparkle update component of the Poedit translation tool, with other pairings built on curl, Vim and TightVNC and DLLs masquerading as Microsoft Office, Broadcom, Intel and NVIDIA components under ProgramData and Program Files (Microsoft Threat Intelligence, 2026-09-28). It hides its strings and constants, checks for debuggers, and extracts a second-stage shellcode loader from a custom encrypted archive that in turn unpacks the main component (Microsoft Threat Intelligence, 2026-09-28). The main component reads its configuration from a file named after a Windows networking library, beacons with an HTTPS GET request whose cookie carries the computer name, user name, process list and Program Files listing, then switches to WebSockets with a binary protocol encrypted with RC4 after a key exchange; its handful of commands chiefly load, unload and pass data to further modules, whose capabilities Microsoft has not confirmed (Microsoft Threat Intelligence, 2026-09-28).

Triage: these tools legitimately load their own DLLs, and in the analysed case the malicious DLL replaced Poedit's own WinSparkle update component in its normal install folder, so the location alone does not decide it; the discriminator is the companion extension-less archive named like the DLL, which a genuine installation does not carry, together with a DLL that differs from the vendor's original component, and for the ProgramData pairings an application folder the organization never deployed (Microsoft Threat Intelligence, 2026-09-28).

Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors.

While Microsoft assesses the activity originates from China, it has not attributed Storm-3069 to a Chinese nation-state actor.

Microsoft has not observed NeedyMantis itself being distributed through a supply chain compromise.

Microsoft Threat Intelligence 2026-09-28

Builds on: Trojanised, validly signed DAEMON Tools installers ran a profiler on thousands of machines and…

threat11 Oct 14:59Zsingle-sourceOpen finding →
Sources: Microsoft Threat Intelligence

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • microsoft.com1 (100%)
All cited sources (1)