--- title: 'NeedyMantis' Provides Long-Term Access to Compromised... description: Microsoft Threat Intelligence has disclosed NeedyMantis, a previously unknown modular malware framework linked to a China-based threat actor tracked as... canonical: https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 'NeedyMantis' Provides Long-Term Access to Compromised Networks | daily.dev og:description: Microsoft Threat Intelligence has disclosed NeedyMantis, a previously unknown modular malware framework linked to a China-based threat actor tracked as... og:url: https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8 og:image: https://api.daily.dev/og/posts/TzvBtPkn8.png og:image:alt: 'NeedyMantis' Provides Long-Term Access to Compromised Networks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 'NeedyMantis' Provides Long-Term Access to Compromised Networks **[Dark Reading](https://daily.dev/sources/dr)** · 4 min read · 1 upvotes · 0 comments ## Summary Microsoft Threat Intelligence has disclosed NeedyMantis, a previously unknown modular malware framework linked to a China-based threat actor tracked as Storm-3069. Active since at least October 2025, the backdoor is designed for post-compromise persistence, giving attackers long-term stealth access after initial network infiltration. It targets telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors. NeedyMantis uses DLL sideloading to hide behind trusted applications like Poedit, curl, Vim, and TightVNC, employs custom encrypted archives with changing encryption keys to resist static analysis, and communicates over HTTPS and WebSockets. Its modular architecture means full capabilities remain unknown. Detection is best achieved through behavioral signals — file copying, DLL loading, unusual network activity — rather than artifact-based detection. Running EDR in block mode is recommended as a defensive measure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is NeedyMantis malware and how does it work? NeedyMantis is a modular post-compromise backdoor framework linked to a China-based threat actor (Storm-3069), active since at least October 2025. It requires prior network access to deploy, then communicates over HTTPS and WebSockets, uses DLL sideloading to hide behind trusted apps like Poedit, curl, Vim, and TightVNC, and employs custom encrypted archives with rotating keys to resist static analysis. Its modular design means additional capabilities can be loaded and many remain unconfirmed. _Security teams tracking nation-state post-compromise tooling find new disclosures like this on daily.dev as they break._ ### How can defenders detect DLL sideloading used by post-compromise malware like NeedyMantis? Detection should focus on attacker behavior rather than malware artifacts alone — specifically file copying activity, unusual DLL loading patterns, and anomalous network traffic. Adversarial exposure validation can test whether existing controls catch sideloaded DLLs and interrupt hands-on-keyboard deployment. Running EDR in block mode provides an additional layer, remediating malicious artifacts detected post-breach even when traditional antivirus misses them. _Defenders hardening against post-compromise persistence techniques track emerging guidance on daily.dev._ ## Similar posts on daily.dev - [Be on the lookout for Mistic, a new backdoor used by ransomware broker](https://daily.dev/posts/be-on-the-lookout-for-mistic-a-new-backdoor-used-by-ransomware-broker-xwsdxgz9b) · CSO Online · 0 upvotes · 0 comments - [Chinese APT deploys new malware to keep access to hacked networks](https://daily.dev/posts/chinese-apt-deploys-new-malware-to-keep-access-to-hacked-networks-1pffgypwt) · BleepingComputer · 0 upvotes · 0 comments - [New backdoors from Toy Ghouls](https://daily.dev/posts/new-backdoors-from-toy-ghouls-4lj9czjc6) · Securelist · 0 upvotes · 0 comments - [Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine](https://daily.dev/posts/trojanized-eset-installers-drop-kalambur-backdoor-in-phishing-attacks-on-ukraine-amw6o2ru1) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"'NeedyMantis' Provides Long-Term Access to Compromised Networks","url":"https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8"},"datePublished":"2026-09-29T15:20:07.861Z","dateModified":"2026-09-29T15:22:05.946Z","description":"Microsoft Threat Intelligence has disclosed NeedyMantis, a previously unknown modular malware framework linked to a China-based threat actor tracked as...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/21cfc2c1a7b19268fbb4ed7931ae1b6f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/21cfc2c1a7b19268fbb4ed7931ae1b6f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"'NeedyMantis' Provides Long-Term Access to Compromised Networks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/needymantis-provides-long-term-access-to-compromised-networks-tzvbtpkn8#faq","mainEntity":[{"@type":"Question","name":"What is NeedyMantis malware and how does it work?","acceptedAnswer":{"@type":"Answer","text":"NeedyMantis is a modular post-compromise backdoor framework linked to a China-based threat actor (Storm-3069), active since at least October 2025. It requires prior network access to deploy, then communicates over HTTPS and WebSockets, uses DLL sideloading to hide behind trusted apps like Poedit, curl, Vim, and TightVNC, and employs custom encrypted archives with rotating keys to resist static analysis. Its modular design means additional capabilities can be loaded and many remain unconfirmed. Security teams tracking nation-state post-compromise tooling find new disclosures like this on daily.dev as they break."}},{"@type":"Question","name":"How can defenders detect DLL sideloading used by post-compromise malware like NeedyMantis?","acceptedAnswer":{"@type":"Answer","text":"Detection should focus on attacker behavior rather than malware artifacts alone — specifically file copying activity, unusual DLL loading patterns, and anomalous network traffic. Adversarial exposure validation can test whether existing controls catch sideloaded DLLs and interrupt hands-on-keyboard deployment. Running EDR in block mode provides an additional layer, remediating malicious artifacts detected post-breach even when traditional antivirus misses them. Defenders hardening against post-compromise persistence techniques track emerging guidance on daily.dev."}}]} ```