Skip to content

Back to the catalog

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
microsoft.comwriteup

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence documents NeedyMantis, a previously unreported modular post-compromise malware family used in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors. The writeup details a multi-stage C++/x64 shellcode loader chain delivered via DLL sideloading (abusing Poedit, curl, TightVNC, Vim, and spoofed Office/Broadcom/Intel/NVIDIA DLLs), a custom encrypted/compressed archive format, a minimized custom PE-like executable format, and a WebSockets-based C2 protocol with RC4 key exchange and modular load/unload commands. Microsoft links observed use to Storm-3069 (tied to the Kaspersky-reported DAEMON Tools supply chain compromise) and China-nexus activity, and provides IOCs, Defender detections, and KQL/Sentinel hunting queries.

TL;DR Microsoft dissects NeedyMantis, a modular post-compromise malware family (linked to Storm-3069/DAEMON Tools) with DLL-sideloaded multi-stage loaders, custom archive/PE formats, and a WebSockets C2 protocol.
Open original ↗
Document

What it is

NeedyMantis is a modular post-compromise malware family documented by Microsoft Threat Intelligence, observed in targeted intrusions since at least October 2025. It was discovered through pivoting off indicators from Kaspersky's DAEMON Tools supply chain compromise investigation, and is linked to Storm-3069 (Microsoft's designator for that compromise) plus at least one other operator, both aligned with China-based activity.

How it works

Deployment chain: a first-stage DLL (e.g., WinSparkle.dll, SHA-256 e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e) is sideloaded alongside legitimate software and extracts a second-stage loader from an accompanying encrypted/compressed archive (named identically to the loader DLL, minus extension). That archive uses XOR + RtlDecompressBuffer to unpack file entries whose offsets and keys vary per sample. The second-stage loader (seen as encryptbase64.ps1, despite the extension it's x64 shellcode) resolves Windows APIs via ROR-hashing (observed rotation value 11) and decodes an embedded minimized-PE-format DLL — the main component.

The main component creates a mutex named <username>-<process name> and handles C2. Configuration is hidden in a spoofed dnsapi.dll file (3448-byte structure in the analyzed sample) holding the C2 host/port/URI and sleep intervals; a spoofed ws2_32.dll implements WebSockets C2 over WinINet (hard-coded user-agent Firefox/21.0) or, in a second variant, Libwebsockets.

sequenceDiagram
    participant Victim
    participant C2
    Victim->>C2: HTTPS GET (Set-Cookie: base64+compressed system info JSON)
    C2->>Victim: Upgrade to WebSockets
    Victim->>C2: 1024-byte random buffer + RC4-encrypted "google.com" probe
    C2->>Victim: Derives RC4 key from buffer, acks random command number
    Note over Victim,C2: Further messages: 44-byte XOR-keyed header + RC4/compressed data

C2 commands are limited: outbound 1110 (hostname/username), 1112 (hard-coded ID like 20001), 1150 (keepalive); inbound 1020/1030 (load/unload module), 1050/1150 (dispatch data), 1070 (clear flags). Module capabilities themselves are unconfirmed.

Preconditions / Affected

NeedyMantis is deployed only after an actor already has environment access (observed post-compromise, in one case via Impacket copying files from a network share). It is not itself distributed via supply chain compromise, though Storm-3069's known supply-chain tradecraft is one plausible access vector. Victimology is narrow and selective: telecoms, universities, medical nonprofits, intergovernmental organizations, government contractors.

What to do

  • Monitor for outbound connections to corp.tripswithengine[.]com.
  • Hunt for sideloaded DLLs matching known masquerade paths/names, e.g. %ProgramFiles%\Poedit\WinSparkle.dll, %ProgramData%\USOShared\libcurl.dll, %ProgramData%\VIM\vim64.dll, %ProgramData%\Intel\jli.dll, %ProgramData%\broadcom\dbghelp.dll.
  • Detect the hard-coded user-agent Firefox/21.0 in network/proxy logs (query provided for both Defender XDR DeviceNetworkEvents/DeviceEvents and Sentinel CommonSecurityLog).
  • Enable Defender EDR in block mode, network protection, and automatic attack disruption; deploy the provided KQL hunting queries (file-event masquerade check, C2 domain search across DeviceNetworkEvents/EmailUrlInfo/etc., and Sentinel TI Mapping analytics for the domain indicator).

Caveats

Microsoft has not attributed Storm-3069 to a specific Chinese nation-state actor, has not confirmed whether all observed activity traces to one operator, and has not determined the capabilities of loadable modules.

Technologies named here

Techniques named here

  • DLL sideloading
  • Obfuscated stack strings
  • Obfuscated constant values
  • Anti-debugging
  • Custom encrypted/compressed file archive format
  • API hashing
  • Custom minimized PE/executable format
  • Mutex-based execution marker
  • C2 over WebSockets with encrypted binary protocol
  • RC4 key exchange obfuscation
  • Modular malware architecture / module loading
  • Masquerading as legitimate files
  • Windows Services persistence
  • Hard-coded user-agent spoofing

Threat actors named here

  • NeedyMantis
  • Storm-3069
  • DAEMON Tools supply chain compromise

Related in Malware & RE