Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft
Source SecurityWeek
Description
NeedyMantis is a modular malware framework used by a China-based threat actor in targeted attacks against telecommunications, government, scientific, manufacturing, retail, medical non-profit, and intergovernmental organizations primarily in Belarus, Russia, and Thailand. It was discovered following the May 2026 Daemon Tools supply chain attack, where thousands of computers were infected. The malware uses a custom executable file format and DLL sideloading for persistence and evasion. It is deployed after initial access to maintain long-term presence and support follow-on operations. The malware communicates with command-and-control servers via WebSockets and can load additional modules to extend its capabilities. The threat actor group behind this malware, Storm-3069, is not attributed to a Chinese nation-state actor. Microsoft has provided a detailed technical analysis but no patch or remediation guidance is indicated.