NeedyMantis: Microsoft details a modular post-compromise framework, found through the DAEMON Tools compromise, used against telecoms, universities, intergovernmental bodies and government contractors

Microsoft Threat Intelligence published its analysis of NeedyMantis on 2026-09-28: a modular post-compromise malware family seen since at least October 2025 in a limited number of targeted operations against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors (Microsoft Threat Intelligence, 2026-09-28). Microsoft found it by pivoting from indicators in Kaspersky's investigation of the DAEMON Tools supply-chain compromise and names Storm-3069, its designator for that activity, as at least one operator; it has seen further NeedyMantis activity beyond Storm-3069 that aligns with activity it associates with China-based actors, has not determined whether one actor is behind all of it, and assesses that Storm-3069's activity originates from China without attributing it to a Chinese nation-state actor (Microsoft Threat Intelligence, 2026-09-28). Microsoft has not seen NeedyMantis itself delivered through a supply chain; it is deployed after the operator already has access, and in one intrusion the operator used Impacket to copy the legitimate application, the malicious DLL and an encrypted archive from a network share and run them (Microsoft Threat Intelligence, 2026-09-28).

The first-stage loader is a DLL sideloaded by the legitimate program it ships with, in the analysed case a fake WinSparkle update component of the Poedit translation tool, with other pairings built on curl, Vim and TightVNC and DLLs masquerading as Microsoft Office, Broadcom, Intel and NVIDIA components under ProgramData and Program Files (Microsoft Threat Intelligence, 2026-09-28). It hides its strings and constants, checks for debuggers, and extracts a second-stage shellcode loader from a custom encrypted archive that in turn unpacks the main component (Microsoft Threat Intelligence, 2026-09-28). The main component reads its configuration from a file named after a Windows networking library, beacons with an HTTPS GET request whose cookie carries the computer name, user name, process list and Program Files listing, then switches to WebSockets with a binary protocol encrypted with RC4 after a key exchange; its handful of commands chiefly load, unload and pass data to further modules, whose capabilities Microsoft has not confirmed (Microsoft Threat Intelligence, 2026-09-28).

Triage: these tools legitimately load their own DLLs, and in the analysed case the malicious DLL replaced Poedit's own WinSparkle update component in its normal install folder, so the location alone does not decide it; the discriminator is the companion extension-less archive named like the DLL, which a genuine installation does not carry, together with a DLL that differs from the vendor's original component, and for the ProgramData pairings an application folder the organization never deployed (Microsoft Threat Intelligence, 2026-09-28).