Microsoft says China-linked operators hand-install NeedyMantis to keep hold of breached networks
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
The Watch · Security desk
What happened
- Operators install NeedyMantis by hand, over remote access, on machines they have already compromised.
- The first-stage loader comes packaged with legitimate open-source programs, including Poedit, curl, Vim and TightVNC, and loads through DLL side-loading.
- A second-stage loader embeds the implant further, and the final stage contacts a command server that lets the operator keep access, exfiltrate data and add components.
- Microsoft ties at least one operator to Storm-3069, a group linked to the Daemon Tools supply chain compromise, but found no evidence NeedyMantis was distributed that way.
Why it matters
- What it limits constraint Detection tuned to the initial break-in does not cover an implant installed afterwards, so teams have to hunt for side-loading on hosts they may already consider handled.
- Who's exposed exposure Telecoms, universities and government-linked bodies that cleaned up an earlier intrusion may still host a working NeedyMantis channel back to the operator.
- Who has to decide decision Teams running endpoint products other than Defender cannot apply most of Microsoft's guidance as written and have to map it onto their own controls for side-loading and unknown binaries.
Next story · Security · 4h ago
Attackers pushed a backdoor through AOMEI Backupper's update servers in windows of 5 to 10 minutesConfirmed2 publishers
Some of the side-loaded DLLs pose as Microsoft Office, Broadcom, Intel and NVIDIA components [9]. The implant is built from C++ modules and x64 shellcode [15]. It also carries anti-analysis code meant to hinder detection by security software and review by human analysts [16].
The order of events decides where a responder can catch this. Microsoft saw NeedyMantis only in environments the operators already held. It assesses that the framework exists to keep that access and support later operations [5]. How the operators get in is still unknown [6]. A hunt can find the install itself: a legitimate open-source program loading a DLL that claims to be an Office, Intel or NVIDIA part [7][9].
Microsoft places the activity in China but has not attributed it to an actor working for the Chinese state [1]. It has not ruled out the supply chain as a way in. "Supply chain activity remains one possible means by which an actor could gain the access necessary to deploy the malware," Microsoft wrote [13].
The dates show a sustained operation. The tooling has been in use since at least October 2025, and Microsoft published its analysis on September 28 [3][10]. Microsoft could not determine whether one operator runs all of it. Storm-3069 is the one operator it names [2].
Microsoft's recommended mitigations are product settings. Three of the four name Microsoft Defender features: EDR in block mode, network protection in Defender for Endpoint and automatic attack disruption in Defender XDR [17][14]. The fourth is cloud-delivered protection with block at first sight, aimed at new and unknown variants [14].
What to watch
- Any finding from Microsoft or other researchers on how NeedyMantis operators gain initial access.
- Attribution of NeedyMantis intrusions to operators other than Storm-3069, which would show whether the framework is shared.
- Indicators of compromise published in a form defenders can use outside the Microsoft Defender stack.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+18
- Incentives40
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 22%
- Operator
- Operator 67%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft attributed NeedyMantis activity as emerging from China but has not attributed it to a threat actor working on behalf of the Chinese state.
- [2]
Microsoft could not determine whether all NeedyMantis activity is attributable to the same operator, but at least one operator is Storm-3069.
- [3]
The NeedyMantis malware operation has been active since at least October 2025.
- [4]
NeedyMantis has been used in hacking campaigns targeting telecommunications providers, universities and government-linked organizations.
- [5]
Microsoft's analysis suggests NeedyMantis is only deployed after the threat actor has already gained access to the environment, and is likely used to maintain long-term access and support follow-on operations.
- [6]
It remains unknown how the NeedyMantis attackers gain initial access.
- [7]
NeedyMantis components have been found packaged alongside legitimate software, which installs the malware through DLL side-loading as part of a first-stage loader.
- [8]
Open-source software abused in NeedyMantis delivery includes Poedit, curl, Vim and TightVNC.
- [9]
Microsoft has seen NeedyMantis elements posing as fake Microsoft Office, Broadcom, Intel and NVIDIA DLL components.
- [10]
Microsoft Threat Intelligence published its NeedyMantis analysis on September 28.
- [11]
NeedyMantis is deployed onto the already compromised system directly by the attacker, using remote hands-on access to install the components.
- [12]
Storm-3069 has been associated with the Daemon Tools supply chain compromise, but Microsoft found no evidence of NeedyMantis being distributed that way.
- [13]
"Supply chain activity remains one possible means by which an actor could gain the access necessary to deploy the malware."
- [14]
Microsoft recommends turning on cloud-delivered protection and block at first sight, running EDR in block mode so Microsoft Defender for Endpoint can block malicious artifacts, enabling network protection in Microsoft Defender for Endpoint, and configuring automatic attack disruption in Microsoft Defender XDR.
- [15]
NeedyMantis is composed of multiple components written in C++ and x64 shellcode.
- [16]
NeedyMantis contains anti-analysis techniques to hinder detection and analysis by security software and cyber defenders.
- [17]
Three of Microsoft's four recommended NeedyMantis mitigations name a Microsoft Defender product.
- [18]
A second-stage loader further embeds NeedyMantis, and the final stage contacts a command and control server that gives the attacker persistent access and the ability to exfiltrate data or install additional components.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comMicrosoft Warns NeedyMantis Malware Enables Persistent Network Access
1 article · September 29, 2026
- securityweek.comDaemon Tools Hackers' NeedyMantis Malware Dissected by Microsoft - SecurityWeek
2 articles · September 29, 2026
- thehackernews.comHackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
2 articles · September 29, 2026