Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Overview

A new malware family known as  NeedyMantis  is drawing attention because of how it is being used: not necessarily to break into networks in the first place, but to help attackers  stay inside networks they have already compromised  

Recent threat research has linked NeedyMantis to a limited number of targeted intrusions involving telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors. Activity involving the malware has been traced back to at least October 2025.

The important point for defenders is simple:  getting an attacker out once is not enough if another persistence mechanism has been left behind  

NeedyMantis appears to be designed around this problem. Its modular architecture, encrypted components, DLL sideloading and command-and-control communications give attackers a way to maintain access and potentially add functionality after the initial compromise.  Microsoft

What Is NeedyMantis?

NeedyMantis is a modular, post-compromise malware family. In the cases investigated so far, attackers were already inside the victim environment before deploying it.

Rather than relying on one obvious malicious executable, NeedyMantis can be packaged alongside legitimate software and use  DLL sideloading  to get executed. The attacker places a legitimate application next to a malicious DLL with a filename that the legitimate application normally expects to load.

Researchers have observed the technique involving legitimate programs such as Poedit, curl, Vim and TightVNC. The malware has also been observed using filenames that imitate components associated with well-known software and hardware vendors.  Microsoft

How the Attack Works

The NeedyMantis infection chain is built in several stages.

First, the attacker obtains access to the environment through some other method. Microsoft has specifically described NeedyMantis as a  post-compromise  tool, meaning the malware is generally deployed after the initial breach.

Next, the attacker introduces a package containing a legitimate executable, a malicious DLL and an encrypted archive.

When the legitimate executable starts, Windows can load the malicious DLL through the normal DLL search process. The victim may therefore see a familiar application running while the malicious code is executing alongside it.

Why the Modular Design Matters

One of the more significant characteristics of NeedyMantis is its modular approach.

The main component manages communications with the attacker's command-and-control infrastructure and can load, unload and communicate with additional modules.

Microsoft has not confirmed the full capabilities of those additional modules, so it would be a mistake to assume that every possible function has been identified.

What is clear, however, is the architectural advantage for an attacker: functionality does not have to be present in one large malware file from the beginning.

The attacker can maintain a relatively small foothold and potentially introduce additional components when required.

That makes detection based solely on known malware signatures less reliable. Defenders need to look at **how legitimate applications are behaving , where they are running from, which DLLs they load and what network connections they make.

Who Has Been Targeted?

Observed NeedyMantis intrusions have affected organizations in several sectors, including:

- Telecommunications

- Universities and other educational institutions

- Medical nonprofits

- Intergovernmental organizations

- Government contractors

What Security Teams Should Watch For

Organizations should treat the following behaviors as useful hunting leads:

Legitimate applications running from unusual locations

Pay particular attention when applications such as Poedit, curl, Vim or TightVNC are executed from unexpected directories.

The presence of a legitimate application alone does not  indicate compromise. The surrounding files, hashes, execution history and network behavior need to be examined.

Suspicious DLL loading

Look for legitimate executables loading unexpected DLLs from their own directories or other unusual locations.

Observed NeedyMantis filenames include:

- `WinSparkle.dll`

- `libcurl.dll`

- `vim64.dll`

- `dbghelp.dll`

- `jli.dll`

- `nvml.dll`

Again, filenames by themselves are not proof of infection because some of these names belong to legitimate software components. Hashes and execution context should be checked before declaring an incident.  Microsoft

Key Takeaways

• NeedyMantis is primarily a post-breach problem.  

The malware is being used after attackers have already gained access, making it especially relevant to incident-response teams.

• Trusted software can be abused  

DLL sideloading allows malicious code to hide behind legitimate applications, making process and file context important.

• Persistence deserves as much attention as initial access.  

An organization can remove the original intrusion mechanism and still remain compromised if additional persistence has been installed.

• Signature-based detection is not enough.  

The malware uses multiple stages, encrypted archives, obfuscation and modular components. Behavioral and network-based detection can provide additional visibility.

• Network monitoring remains valuable.  

Known C2 infrastructure, unusual outbound connections and WebSocket activity can provide useful evidence during an investigation.

• The threat appears targeted rather than broadly distributed.  

Observed victims span strategically important sectors, but the number of documented incidents remains limited.

• Attribution should be handled carefully

Microsoft currently links some observed activity to Storm-3069 and activity it associates with China, while explicitly noting uncertainty about whether all activity comes from the same operator.

Final Assessment

NeedyMantis is a good example of how modern intrusions are increasingly about maintaining access rather than simply gaining it.

Once an attacker has crossed the perimeter, the real danger may be what happens next: additional tools are introduced, legitimate applications are abused, credentials are harvested, internal systems are accessed and persistence mechanisms are established.