Microsoft Threat Intelligence has uncovered NeedyMantis, a modular post-compromise malware framework used in a limited set of targeted intrusions against telecommunications providers, government contractors, universities, medical nonprofits, and intergovernmental organizations.
The malware deploys after attackers gain access, enabling persistent control, covert command-and-control communications, and modular follow-on activity.
Microsoft said NeedyMantis activity dates to at least October 2025 and emerged during its investigation of indicators connected to the DAEMON Tools supply-chain compromise.
Microsoft Tracks NeedyMantis Post-Compromise Malware
At least one operator, tracked as Storm-3069, has used the malware. Microsoft assesses the activity aligns with threat actors operating from China, but has not attributed Storm-3069 to a specific Chinese state-sponsored group or confirmed that all NeedyMantis incidents involve the same operator.
NeedyMantis is not believed to be the initial access vector. Instead, operators introduce it after compromising an environment, making its delivery path flexible across incidents.
In one case, attackers used the Impacket toolkit during hands-on-keyboard activity to copy a legitimate application, a malicious DLL, and an associated archive from a network share to a victim device. The malware abuses DLL sideloading by posing as a required DLL for legitimate software.
Microsoft observed malicious components packaged with Poedit, curl, Vim, and TightVNC, while other samples impersonated DLLs associated with Microsoft Office, Broadcom, Intel, and NVIDIA. Examples included WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, and nvml.dll.
A first-stage loader, commonly masquerading as one of these DLLs, is triggered when the legitimate executable runs. It extracts the next stage from a companion archive named after the loader DLL, such as WinSparkle or libcurl, then executes it.
Microsoft analyzed a Poedit-related sample in which the malicious WinSparkle.dll replaced the legitimate WinSparkle update component.
NeedyMantis uses C++ components, x64 shellcode, custom encrypted archives, string obfuscation, API hashing, and anti-debugging methods.
Its archive format uses XOR decoding and Windows RtlDecompressBuffer decompression, with per-sample offsets and keys that complicate static analysis.
One analyzed archive contained legitimate 7-Zip and Sysinternals files alongside malicious payloads. The second-stage loader, named encryptbase64.ps1, was not a PowerShell script despite its extension; it contained x64 shellcode that decrypted and decompressed the core malware component.
The main component creates a mutex based on the username and process name, such as Contoso-Poedit.exe, manages C2 communications, and loads extra modules supplied by operators.
Its modular structure supports commands to load or unload extensions, dispatch data to active modules, and maintain access, although Microsoft has not confirmed the capabilities of downloaded modules.
NeedyMantis stores configuration data in a fake dnsapi.dll file and uses a spoofed ws2_32.dll as its communications library. One analyzed configuration pointed to corp.tripswithengine[.]com over TCP port 443 with the URI /library/zip/.
The malware begins with an HTTPS request that carries victim information in a compressed, Base64-encoded cookie.
It then upgrades communications to WebSockets and exchanges a proprietary binary protocol protected through XOR encoding, compression, and optional RC4 encryption.
The communications module used a hard-coded Firefox/21.0 user agent, providing defenders with an additional hunting signal.
Mitigation
Organizations should investigate outbound connections to corp.tripswithengine[.]com, suspicious DLL loading from unexpected application directories, and activity involving the Firefox/21.0 user agent.
Security teams should also hunt for altered DLLs in Poedit, curl, Vim, TightVNC, Office, Broadcom, Intel, and NVIDIA-themed folders.
Microsoft recommends enabling cloud-delivered protection, block-at-first-sight, network protection, EDR in block mode, and attack surface reduction rules that block low-reputation executables and obfuscated scripts.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
