Microsoft warns of NeedyMantis malware in targeted attacks

Microsoft researchers have identified ongoing attacks using a malware framework called NeedyMantis to maintain long-term access within already compromised networks. Active since at least October 2025, NeedyMantis has targeted telecoms, universities, government-linked organizations, and medical nonprofits. The malware is deployed manually by attackers, often hidden within legitimate open-source software using DLL sideloading. Microsoft attributes some activity to the Storm-3069 hacking group but has not found evidence of NeedyMantis spreading through a supply chain attack.

• NeedyMantis used to maintain access in breached networks
• Targets include telecoms, universities, and nonprofits
• Delivered via DLL sideloading inside open-source software
• Manual installation by hackers after gaining access
• Microsoft attributes some activity to group Storm-3069