NeedyMantis malware used for long-term network access

Hackers are using a malware family known as NeedyMantis to maintain long-term access to compromised networks, according to Microsoft. This malware has been observed in targeted intrusions affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors, with its use dating back to at least October 2025, as reported by The Hacker News.

NeedyMantis uses a DLL sideloading technique, where a malicious DLL file, often disguised with a legitimate program's file name, is loaded by a legitimate application. Examples of legitimate programs used include Poedit, curl, and TightVNC, with malicious DLLs mimicking files from Microsoft Office, Intel, and NVIDIA. Once loaded, the malware unpacks its main component from an encrypted archive, establishing a command-and-control connection over HTTPS and then switching to a WebSocket for further communication. This allows attackers to load additional modules and exfiltrate data.

Microsoft attributes some of this activity to a group temporarily named Storm-3069, which appears to originate from China, though it has not been directly linked to a nation-state actor. The malware has also been observed outside of Storm-3069's activity, suggesting multiple groups may be employing it. Defenders can check for NeedyMantis using specific file hashes, domains, file paths, and hunting queries provided by Microsoft.

Source: The Hacker News