Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 67%
- Investor
- Investor 11%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+18
- Incentives40
- Confidence60
Admins reinstalled Windows after Defender scans began crashing with 0xc0000005 errors. The remedy was a newer signature build, which is not the same thing as a rollback.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence60
Microsoft Defender Experts says fake Kaspersky, Razer and Calibre download sites all funnel to one delivery host that rebuilds the installer per request, which leaves hash blocking almost nothing durable to match.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives40
- Confidence70
ClickFix scales by asking employees to paste the command themselves
Microsoft says the technique now reaches thousands of enterprise and end-user devices every day. Because the employee is the one who runs the code, the control that binds is a rule about pasting into shells rather than another agent.
Reality
- Evidence61
- Adoption71
- Hype gap+14
- Incentives70
- Confidence58
Attackers reached a domain controller through one exposed SolarWinds helpdesk
Microsoft's Defender team cannot say which of three SolarWinds flaws opened the door, because the December hosts were vulnerable to all of them, which makes the exposure list more useful than the patch list.
Reality
- Evidence62
- Adoption45
- Hype gap−8
- Incentives68
- Confidence55