Actor Profile

NeedyMantis is a modular post-compromise malware framework, not a threat actor. It has been observed in use by at least one operator, Storm-3069 (linked to the DAEMON Tools supply chain compromise). Microsoft assesses the activity originates from China but has not attributed it to a specific Chinese nation-state actor. Evidence suggests NeedyMantis may be used by multiple operators, as observed activity extends beyond Storm-3069's DAEMON Tools campaign. The malware is deployed selectively after initial access has been established, indicating its purpose is to maintain long-term persistence and support follow-on operations rather than serve as an initial access vector.

TTPs (Tactics, Techniques, Procedures)

NeedyMantis employs DLL sideloading (T1574.002) by masquerading as legitimate DLL components for software including Poedit, curl, Vim, TightVNC, Microsoft Office, Broadcom, Intel, and NVIDIA. The malware uses custom encrypted file archives and a custom executable format to evade analysis. Post-compromise deployment has been observed using Impacket toolkit for lateral movement (T1021) and file copying from network shares. The framework features a multi-stage loader architecture with modular components enabling extensible functionality. Command-and-control communications support persistent access. Activity dates to at least October 2025, with selective deployment patterns consistent with espionage operations.

Targets & Patterns

NeedyMantis has been observed targeting telecommunications organizations, universities, intergovernmental organizations, medical nonprofits, and government contractors. This victimology, combined with limited deployment and alignment with China-associated threat actor activity, indicates highly selective targeting consistent with intelligence collection objectives. The targeting profile aligns with Chinese strategic interests, particularly sectors involving critical infrastructure, research institutions, international governance bodies, and defense supply chains. The selective nature and post-compromise deployment suggest operators prioritize stealth and long-term access over broad distribution, focusing on high-value targets where sustained intelligence gathering is the primary objective.

Historical Context

NeedyMantis activity dates back to at least October 2025. Microsoft discovered the malware family through follow-on analysis of indicators associated with Kaspersky's investigation into the DAEMON Tools supply chain compromise. Storm-3069, the threat actor associated with the DAEMON Tools campaign, is one known operator of NeedyMantis. However, Microsoft has observed additional NeedyMantis activity beyond Storm-3069's operations, suggesting the framework may be shared among multiple China-linked operators or represents a common toolset. The malware's architecture and selective deployment patterns are consistent with long-standing Chinese APT tradecraft emphasizing operational security and persistent access.

Defensive Recommendations

  • Monitor for DLL sideloading activity (T1574.002) involving legitimate software such as Poedit, curl, Vim, TightVNC, and suspicious DLL loads from paths like %ProgramData% and %ProgramFiles% directories, particularly for files named WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, and nvml.dll
  • Detect Impacket toolkit usage and lateral movement via SMB file shares (T1021.002), especially copying of legitimate software bundles with accompanying DLL files and archives lacking file extensions
  • Implement application control policies to prevent execution of unsigned or unexpected DLLs loaded by legitimate applications, and audit DLL search order hijacking opportunities
  • Hunt for custom encrypted file archives stored alongside DLL files with matching base names (e.g., WinSparkle.dll paired with WinSparkle archive file) that may indicate NeedyMantis packaging
  • Deploy Microsoft Defender detections for NeedyMantis and enable tamper protection, behavioral monitoring, and cloud-delivered protection to identify modular malware frameworks with custom loaders and encrypted components