Hackers Use Needy Mantis to Maintain Long-Term Access in Breached Networks
Summary: Microsoft reported that a malware family called NeedyMantis has been used to keep long-term access to already-breached networks, in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors, with use dating back to at least October 2025. It arrived through DLL sideloading, bundling a legitimate program such as Poedit, curl, Vim, or TightVNC with a malicious DLL and an encrypted archive, and Microsoft found it while following up on Kaspersky's investigation into the DAEMON Tools supply chain attack, whose signed installers carried malicious code from April 8, 2026 until the developer replaced them on May 5.
Why it matters: Microsoft's published hunting queries look back only seven days, while the files it dated were first seen in October 2025 and May 2026, so run unchanged they would miss the activity they were built to find. Microsoft assesses Storm-3069's activity appears to originate in China but has not tied the group to a Chinese nation-state actor, and it has not determined whether all NeedyMantis activity comes from a single actor.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026