Microsoft, Technical Analysis
|
NeedyMantis is a family of malware that hackers have used to keep long-term access to networks they have already compromised. |
A few targeted hacks at government contractors, universities, medical nonprofits, telecommunications companies, and intergovernmental organizations have been linked to the malware. It has been in use since at least October 2025.
Following up on clues from Kaspersky's investigation into the supply chain attack on DAEMON Tools, Microsoft discovered NeedyMantis. In that attack, malicious malware from April 8, 2026 was present in official, signed installers for the DAEMON Tools Lite disk image application. On May 5, the developer swapped them out with a clean version.
Microsoft uses Storm-3069 to monitor the behavior connected to that attack.
Microsoft
|
Although it hasn't witnessed the malware itself spread via a supply chain attack, Storm-3069 is one group that employs NeedyMantis. The file hashes, domains, file paths, and hunting queries that Microsoft disclosed and described below can be used by defenders to examine their networks. |
How NeedyMantis Runs?
NeedyMantis arrived as a bundle of three components in the cases Microsoft looked at: an encrypted archive with the same name as the DLL, a malicious DLL named after a file that the program loads, and a copy of a legal program. The malicious DLL is loaded when the program launches. DLL sideloading is the term for this.
The Poedit translation tool, curl, the Vim text editor, and the TightVNC remote access tool are examples of legitimate applications that are used in this manner. Additionally, the malware has impersonated DLL files from Intel, NVIDIA, Broadcom, and Microsoft Office.
The malicious file took the place of WinSparkle in the sample that Microsoft thoroughly examined.dll, Poedit's update component.
In one instance, the bundle was copied from a network share and executed on a target computer by an operator who was already inside the network using the Impacket toolkit. The initial method by which an attacker enters a network may vary depending on the type of intrusion.
After loading, the DLL unpacks and executes the subsequent step from the encrypted archive. The primary component of the malware is decoded at that point. The primary component establishes an HTTPS connection to a command-and-control (C2) server before switching to a WebSocket connection.
Operators can transfer data to additional modules and load and unload them via that connection. The functionality of those modules has not been verified by Microsoft.
An earlier version that was released in October 2025 had a Windows service-based persistence module. How the updated version it examined remained on a computer was not explained by Microsoft.
Who Is Behind It?
Storm-3069 is an interim moniker. Microsoft assigns new or emerging groups "Storm" names until it is certain of their origins or identity.
Microsoft claims that many groups may be utilizing the virus after observing NeedyMantis outside of Storm-3069's involvement in the DAEMON Tools campaign. It has not clarified the connection between Storm-3069 and NeedyMantis, nor has it established whether all of the activity originates from a single individual.
Microsoft believes that Storm-3069's actions seem to come from China, but it hasn't connected the organization to a Chinese nation-state actor. All of the NeedyMantis behavior that Microsoft has observed thus far aligns with the groups that it associates with China. Targets that support Chinese interests and the malware's use against a small number of carefully chosen companies are two examples.
Chinese-language text was discovered in the malware when Kaspersky revealed the DAEMON Tools attack in May, but it did not identify any specific gang.
The perpetrator responsible for the DAEMON Tools campaign is identified by Google Threat Intelligence Group as UNC6863.
UNC6863 was identified by Mandiant in June as "a suspected China-nexus actor" who utilized the DAEMON Tools hack to spread malware. Whether UNC6863 and Storm-3069 are members of the same group is unknown.
How to Check for NeedyMantis?
Microsoft published these indicators of compromise:
a) SHA-256:
e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e (first-stage loader WinSparkle.dll, first seen May 21, 2026)
b) SHA-256:
9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef (encrypted archive named WinSparkle, first seen May 23, 2026)
c) SHA-256:
c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 (encrypted archive named libcurl, older version, first seen October 3, 2025)
d) Domain: corp.tripswithengine[.]com (C2 server, port 443)
e) User Agent: firefox/21.0 (hard-coded in the malware's communications DLL)
These are some of the file paths used by the malicious DLLs:
● %ProgramFiles%\Poedit\WinSparkle.dll
● %ProgramData%\USOShared\libcurl.dll
● %ProgramData%\VIM\vim64.dll
● %ProgramData%\TightVNC\VIM\vim64.dll
● %ProgramData%\office\dbghelp.dll
● %ProgramData%\broadcom\dbghelp.dll
● %ProgramData%\Intel\jli.dll
● %ProgramFiles%\modifiable\nvml.dll
● %ProgramData%\ics\nvml.dll
The malware is identified by Microsoft Defender Antivirus as TrojanDropper:Win64/NeedyMantis and Behavior:Win64/NeedyMantis. Additionally, Microsoft released hunting queries that search Defender XDR for these paths, as well as Microsoft Sentinel and Defender XDR for the C2 domain and user agent.
Every query only looks back seven days. The files it detected were initially discovered in October 2025 and May 2026, and Microsoft has not stated whether NeedyMantis is still in use. The queries would not find events from those months if they were run unaltered.
An infection cannot be shown by a hit on the Poedit path alone. Compare any file discovered in WinSparkle.dll with the published hash since it is also a standard component of Poedit.
Cloud-delivered protection, block at first sight, EDR in block mode, network protection, automatic attack disruption, and two attack surface reduction rules are among the Defender options that Microsoft suggests. Additionally, it suggests looking for links to the C2 domain in outgoing traffic, a step that doesn't require Defender.
NeedyMantis has not been detected by Microsoft using the altered DAEMON Tools installation. The developer has recommended that anyone who downloaded or installed the free DAEMON Tools Lite 12.5.1 during the impacted time delete it, perform a thorough system check, and download version 12.6 from the official website.
Conclusion
Now that we have talked about such a tricky situation created by cyberattackers, you might want to ensure your safety against such attempts. For that, you can go for ThreatFusionAI, a dedicated threat intelligence platform offered by Craw Security.
This amazing platform helps organizations by notifying them about the latest cyber threats and malicious attempts so that they can improve their security measures in time. What are you waiting for? Contact, Now!
