Microsoft’s threat intelligence arm has identified a new malware framework, dubbed NeedyMantis, engineered to give attackers long-term covert access inside networks already compromised. The malware is modular and tailored for espionage rather than widespread financial crime, with its use traced back to at least October 2025.
Targets & Discovery
The malware has been spotted in a small number of high-value attacks affecting telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government contractors. In each case, NeedyMantis was deployed after attackers had already breached the victims’ networks, suggesting it’s used to maintain stealth and persistence rather than initiate intrusion. Microsoft first linked it to investigations into the DAEMON Tools supply-chain compromise, known as Storm-3069. Although the DAEMON Tools binaries were corrupted in that incident, Microsoft found no evidence that NeedyMantis was delivered through that supply chain directly.
Operation & Architecture
The framework’s deployment varies—one analyzed incident involved using the Impacket toolkit to transfer legitimate software, a malicious DLL, and an encrypted archive into the network, followed by execution on a chosen device. NeedyMantis makes heavy use of DLL sideloading so that legitimate applications load malicious libraries disguised as system or well-known vendor components—for example, applications like Poedit, curl, Vim, and TightVNC being used to camouflage attackers’ code, which can appear to reference Microsoft, Broadcom, Intel or NVIDIA libraries.
Once active, the first-stage loader unpacks a second-stage payload from a custom archive whose filenames, XOR keys, offsets, and compression schemes change between versions to avoid detection. One sample replaced WinSparkle’s update module in Poedit, then used obfuscation techniques like stack strings and runtime resolution of Windows APIs. A PowerShell-looking file was dropped, but it actually contained 64-bit shellcode which further decoded and decompressed the core implant in a custom format.
Command & Control and Communication
NeedyMantis initiates contact with its command-and-control server via HTTPS requests to a host known as corp.tripswithengine[.]com, using port 443 and the path /library/zip/. The initial request carries system data encoded in a Set-Cookie header—details like user name, computer name, running processes, parent process, file installations, etc. After this exchange, communication upgrades to WebSockets using a custom binary protocol, which may involve XOR encoding, compression, or optional RC4 encryption.
The malware supports modular functionality: commands can load or unload modules, gather data, disable flags, maintain identification messages, and keep connections alive. Though Microsoft has not yet confirmed the full scope of the downloadable modules’ capabilities, the architecture allows operators to adapt their toolset without rebuilding the core payload.
Detection & Recommendations
This framework poses a particular risk to sensitive sectors—those involved in research, public service, healthcare, and critical infrastructure. Because it is deployed only after other threats have already breached a network, its detection should immediately trigger deep incident investigations covering earlier attacker activity such as credential theft, movement laterally, persistence mechanisms, and staging infrastructure.
Microsoft advises defenders to search networks for signs like outbound traffic to corp.tripswithengine[.]com, illegitimate DLLs loaded by trusted apps, use of Impacket tools, obfuscated decoding routines, or archives placed next to legitimate applications. Recommended protections include cloud-delivered defenses, block-at-first-sight heuristics, network protection tools, EDR platforms in block mode, attack-surface-reduction rules against untrusted executables and obfuscated scripts, and automatic attack disruption techniques.
Detections for NeedyMantis include identifiers such as TrojanDropper:Win64/NeedyMantis and Behavior:Win64/NeedyMantis, plus alerts triggered by sideloading or Impacket-based methods.
