NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.
Indicators of Compromise
- hash: e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e
- hash: 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef
- hash: c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77
- domain: corp.tripswithengine.com
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Description
NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/"]
- Adversary
- Storm-3069
- Pulse Id
- 6abac5fd70758a52b56cb48e
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hashe842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e | — | |
hash9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef | — | |
hashc82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domaincorp.tripswithengine.com | — |
Threat ID: 6abc0536680226ef681ded0e
Added to database: 09/29/2026, 18:36:38 UTC
Last updated: 09/29/2026, 18:36:38 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.