NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

• PEERSTITCH, a Stealthy FortiGate ImplantMalware2026-10-14
• How AI Revived a Stalled Attack on a U.S. RetailerMalware2026-11-12
• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03
• SMTP is the key: BPFDoor and AVERAT hitting the network edgeMalware2026-10-02
• Synacor Zimbra Collaboration Suite (ZCS) · Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570ExploitedVulnerability2026-09-30