'NeedyMantis' Provides Long-Term Access to Compromised Networks

NeedyMantis is a newly identified modular post-compromise backdoor framework observed by Microsoft in targeted intrusions since at least October 2025 against telecoms, academia, nonprofits, intergovernmental organizations, and contractors; it uses DLL sideloading, custom encrypted archives, HTTPS/WebSocket command-and-control, and a two-stage loader to maintain long-term stealthy access, and has been linked to the China-based threat actor Storm-3069 while likely enabling undisclosed additional modules and capabilities.