Microsoft analyzed NeedyMantis, a modular malware framework used by a China-based threat actor in targeted attacks following the May 2026 Daemon Tools supply chain compromise. The malware employs a multi-stage loader chain abusing DLL sideloading to execute a custom executable file format designed for persistence and evasion. It establishes WebSockets-based command-and-control communication to receive commands, load or unload modules, and exfiltrate system and user information. The malware is deployed post-compromise to maintain long-term access and support further operations. The threat actor group, Storm-3069, has targeted organizations in Belarus, Russia, and Thailand across various sectors. The malware has been active since at least October 2025 and is used exclusively in targeted attacks. No attribution to a Chinese nation-state actor has been made.

The malware enables threat actors to maintain persistent, long-term access to compromised environments after initial intrusion. It supports modular expansion of capabilities, potentially allowing attackers to conduct various follow-on operations. The infection affected thousands of computers via a poisoned supply chain and resulted in backdoors on multiple systems in sensitive sectors. The targeted nature and persistence mechanisms increase the risk of espionage, data exfiltration, and operational disruption within affected organizations.

No specific patch or remediation is indicated in the available information. As NeedyMantis is deployed post-compromise, organizations should focus on preventing initial access and detecting post-compromise activity. Microsoft’s analysis does not mention any official fix or temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.