Microsoft Unpacks NeedyMantis, a Modular Post-Compromise Malware Family

Introduction

Microsoft Threat Intelligence has published an in-depth analysis of NeedyMantis, a modular malware family observed in a limited number of targeted intrusions involving telecommunications organisations, universities, medical nonprofits, intergovernmental organisations and government contractors.

Microsoft says NeedyMantis is typically deployed after an attacker has already gained access to a target environment. Rather than serving primarily as an initial access mechanism, the malware appears to support continued access and follow-on activity inside compromised environments.

The activity dates back to at least October 2025. Microsoft identified NeedyMantis while analysing indicators connected to the DAEMON Tools supply chain compromise, which had previously been investigated by Kaspersky.

Microsoft currently associates observed NeedyMantis activity with activity linked to threat actors operating from China. However, Microsoft has not determined whether all observed activity belongs to the same operator and has not attributed Storm-3069, the actor associated with the DAEMON Tools activity, to a Chinese nation-state actor.

The malware's architecture is notable for combining multiple loaders, custom encrypted and compressed archives, a custom executable format, anti-analysis techniques and a modular command-and-control system.

NeedyMantis Appears After Initial Access

One of the most important characteristics of NeedyMantis is where it appears in the intrusion lifecycle.

Microsoft's observations indicate that threat actors generally deploy the malware after they have already established access to a victim environment. This means the initial compromise can occur through different methods, with NeedyMantis introduced later as part of post-compromise activity.

Microsoft observed one incident in which an operator used the Impacket toolkit during hands-on-keyboard activity. The attacker copied legitimate software, a malicious DLL and the malware's file archive from a network share before executing them on a targeted system.

Microsoft has also clarified an important distinction around supply chain attacks. Although Storm-3069 has been associated with the DAEMON Tools supply chain compromise, Microsoft has not observed NeedyMantis itself being distributed through a supply chain compromise.

Supply chain activity could nevertheless provide an attacker with the access required to deploy the malware later in an intrusion.

Who has been targeted?

Microsoft has observed NeedyMantis in intrusions involving:

• Telecommunications organisations

• Universities

• Intergovernmental organisations

• Medical nonprofits

• Government contractors

The limited observed deployment and selective victim targeting suggest that NeedyMantis is not currently being used as a broad, indiscriminate malware campaign.

Microsoft has also observed activity beyond the Storm-3069-associated incidents, raising the possibility that more than one operator has access to or uses the malware.

However, Microsoft has not determined whether these separate observations are attributable to the same threat actor.

How NeedyMantis Is Packaged

NeedyMantis consists of multiple components written in C++ and x64 shellcode.

The initial package contains a first-stage loader and a file archive. The loader is disguised as a legitimate DLL required by another application and is executed through DLL sideloading.

Microsoft observed the malware being packaged alongside legitimate software including:

• Poedit

• curl

• Vim

• TightVNC

It has also been observed masquerading as DLL components associated with Microsoft Office, Broadcom, Intel and NVIDIA.

Examples identified by Microsoft include:

WinSparkle.dll
libcurl.dll
vim64.dll
dbghelp.dll
jli.dll
nvml.dll

The malware's archive uses the same base name as the loader DLL. For example, a WinSparkle.dll loader is accompanied by a WinSparkle archive.

This naming approach allows the malicious components to appear alongside legitimate application files while the legitimate software provides the execution path for the sideloaded DLL.

First-Stage Loader Uses Anti-Analysis Techniques

The first-stage loader has a relatively focused purpose: extract the second-stage loader from the custom archive and continue execution.

In Microsoft's analysed sample, the malicious DLL was named WinSparkle.dll, while the corresponding archive was named WinSparkle.

Microsoft says the sample spoofed and replaced the WinSparkle software update component used by Poedit.

The loader also contains several anti-analysis mechanisms.

Important strings are stored as obfuscated stack strings. Individual parts of a string are constructed on the function's stack and subsequently deobfuscated through mathematical operations.

Many of these strings contain Windows DLL and API names, which are resolved dynamically at runtime.

The loader also stores numerous constant values in obfuscated form.

Two anti-debugging techniques were identified:

• ProcessDebugFlags

• ThreadHideFromDebugger

These techniques make static and dynamic analysis more difficult by hiding important information until runtime and attempting to detect or interfere with debugging.

Custom Encrypted Archives Hide Malware Components

One of the more distinctive aspects of NeedyMantis is its custom file archive format.

Microsoft found that the archive is both encrypted and compressed.

The unpacking process involves:

1. XOR-decoding the outer archive layer.

2. Decompressing it using RtlDecompressBuffer.

3. Processing individual file entries.

4. XOR-decoding file names.

5. Decompressing the contents of individual entries.

The offsets, XOR keys and values can change between samples.

This means analysts cannot necessarily rely on one fixed archive structure when examining different NeedyMantis samples.

What can the archive contain?

One analysed archive contained 11 files, including legitimate components from 7-Zip and Sysinternals alongside NeedyMantis components.

The archive included:

• 7-zip.chm

• 7-zip.dll

• 7-zip32.dll

• 7z.exe

• Disk2vhd.dll

• main.dll

• kernel32.dll

• encryptbase64.ps1

• dnsapi.dll

• ws2_32.dll

• msvcrt140.dll

Several filenames are deliberately misleading.

For example, Microsoft notes that dnsapi.dll is not the legitimate Windows DNS API library. Instead, it contains the malware's configuration.

Similarly, ws2_32.dll contains a WebSockets communication component, while msvcrt140.dll contains shellcode used to load modules and resolve exports.

An older NeedyMantis archive observed by Microsoft had a different structure and contained only four files, showing that the malware's packaging can change between versions.

A PowerShell Extension That Is Not PowerShell

The second-stage loader adds another layer of complexity.

In Microsoft's analysed sample, the file is called:

encryptbase64.ps1

Despite the .ps1 extension, Microsoft found that the file contains x64 shellcode rather than a conventional PowerShell script.

Its role is to decode and decompress an embedded binary containing NeedyMantis' main component.

The second-stage loader uses encoded data blocks and XOR keys stored at calculated offsets. These locations can change between samples.

It also contains Windows DLL names and API hash values.

Microsoft found that the loader uses a rotate-right-based algorithm to resolve Windows API hashes. The analysed sample used a rotation value of 11.

After decoding and decompression, the resulting DLL is stored in a custom executable format.

Microsoft describes this as a minimised version of a PE file.

This additional transformation creates another analysis layer between the initial loader and the malware's primary functionality.

The Main Component Controls C2 and Modules

Once the main component is loaded, it becomes responsible for command-and-control communications and managing additional modules.

It also creates a mutex based on the username and process name. Microsoft gives Contoso-Poedit.exe as an example of the naming pattern.

The main component continues the use of obfuscated stack strings and obfuscated constant values.

Configuration

The malware's configuration is stored inside the archive under the misleading filename dnsapi.dll.

In Microsoft's analysed sample, the configuration contains a 3,448-byte binary structure.

Among the identified fields were:

• Communication component: ws2_32.dll

• C2 port: 443

• C2 host: corp.tripswithengine[.]com

• C2 URI: /library/zip/

• Proxy username and password fields

• Sleep-related values

The use of a filename associated with a legitimate Windows networking library adds another layer of masquerading to the malware's internal structure.

WebSockets Provide the C2 Channel

The communications component is stored as ws2_32.dll inside the custom archive.

Microsoft found that the component exposes an export named SystemInfo, which provides functions for establishing and maintaining a WebSockets connection with the command-and-control server.

One version uses WinINet APIs for WebSockets and contains a hard-coded user-agent:

Firefox/21.0

Microsoft also identified another version of the communications DLL that implements the same API through Libwebsockets.

The initial C2 communication begins with an HTTPS GET request.

Information about the compromised system is included in the Set-Cookie header. After decoding and decompression, Microsoft found information including:

• Computer name

• Username

• Process name

• Parent process

• Files in the Program Files directory

• Process list

The connection then transitions to WebSockets and continues using a binary protocol.

NeedyMantis Uses Multiple Layers in Its C2 Protocol

The binary C2 protocol includes a header and optional data components.

The header contains information such as:

• XOR key

• Uncompressed data length

• Compressed data length

• Command number

• Data length

Data can be compressed using RtlCompressBuffer and may also be encrypted using RC4.

The initial protocol messages perform a key exchange. Microsoft observed the malware generating a random buffer and using part of it to establish an RC4 key for subsequent communication.

The protocol also includes an encrypted buffer beginning with google.com, followed by random data.

Microsoft says the C2 server can use information in the exchange to recreate the RC4 key and presumably validate the encrypted buffer.

Modular Design Allows Additional Functionality

The main component contains a relatively small number of direct commands.

Commands sent from the malware to the C2 server include:

• 1110 - Sends computer name and username

• 1112 - Sends a hard-coded identifier

• 1150 - Keep-alive

Commands received from the C2 server include:

• 1020 - Load module

• 1030 - Unload module

• 1050 / 1150 - Dispatch data to a module

• 1070 - Turn off active flags

The load, unload and dispatch functionality demonstrates that NeedyMantis can extend its capabilities through additional modules.

However, Microsoft explicitly states that the capabilities of those modules remain unconfirmed.

That distinction is important. The architecture demonstrates extensibility, but the available research does not establish what every possible module can do.

Microsoft Detection and Mitigation Guidance

Microsoft provides several defensive recommendations for organisations investigating or protecting against NeedyMantis.

The company recommends monitoring outbound network traffic for connections to:

corp.tripswithengine[.]com

Microsoft also recommends enabling cloud-delivered protection and Block at First Sight to help identify and block new or unknown malware variants.

For Microsoft Defender for Endpoint environments, Microsoft recommends:

• Running EDR in block mode

• Enabling network protection

• Configuring automatic attack disruption

• Reviewing relevant attack surface reduction rules

The identified attack surface reduction rules include blocking executable files unless they meet specified prevalence, age or trusted-list criteria, and blocking execution of potentially obfuscated scripts.

Microsoft also provides Defender detections covering suspicious DLL loading, unexpected DLL loading, suspicious decoding activity, NeedyMantis malware, Impacket activity and related network behaviour.

Threat Hunting Opportunities

Microsoft has published hunting queries for Microsoft Defender XDR and Microsoft Sentinel customers.

The Defender XDR queries can help organisations search for:

NeedyMantis masquerading as legitimate software

The query looks for known malicious DLL filenames appearing in application directories associated with software such as Poedit, Vim, TightVNC and other masqueraded locations.

NeedyMantis C2

The query searches multiple security telemetry sources for:

corp.tripswithengine.com

Hard-coded user-agent

Another query searches for the hard-coded:

Firefox/21.0

user-agent associated with the NeedyMantis communications DLL.

Microsoft Sentinel customers can also use TI Mapping analytics to identify malicious domain indicators through Threat Intelligence integrations.

Indicators of Compromise

Microsoft published the following key indicators:

What NeedyMantis Shows About Post-Compromise Malware

The NeedyMantis research highlights a broader security challenge: detecting threats that arrive after an organisation has already been compromised.

Traditional prevention controls focused heavily on initial access may not provide sufficient visibility into every stage that follows an intrusion.

NeedyMantis demonstrates how an attacker can combine legitimate software, DLL sideloading, misleading filenames, custom archives, shellcode, anti-analysis techniques and modular C2 communication within one framework.

The architecture also shows why defenders need visibility across multiple layers of an endpoint environment.

A malicious DLL may initially resemble a legitimate software component. An archive may contain genuine software files alongside malware. A file carrying a PowerShell extension may actually contain shellcode. A filename such as dnsapi.dll may not represent the Windows component it appears to be.

For enterprises, this could mean that security monitoring needs to consider behaviour and execution relationships, not simply filenames or file extensions.

The research also highlights the importance of post-compromise detection. Microsoft provides network indicators, file hashes, hunting queries and endpoint detections that can help defenders investigate these behaviours.

Conclusion

Microsoft's analysis of NeedyMantis provides a detailed look at a malware family designed to operate within already compromised environments.

Its architecture combines DLL sideloading, encrypted and compressed custom archives, multiple loaders, shellcode, obfuscated strings, API hashing, a custom executable format, WebSockets-based C2 communication and support for additional modules.

The malware has so far been observed in a limited set of targeted operations involving organisations across several sectors. Microsoft currently associates observed activity with activity linked to China-based threat actors, while noting that it has not determined whether all NeedyMantis activity is controlled by the same operator.

For defenders, the most useful elements of the research are the concrete detection opportunities: suspicious DLL sideloading, known file hashes, the identified C2 hostname, the hard-coded Firefox/21.0 user-agent and Microsoft's published hunting queries.

The findings reinforce the importance of monitoring not only how an attacker enters an environment, but also how malicious tooling is introduced, executed and maintained after initial access.