NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence details NeedyMantis, a sophisticated modular post-compromise malware used in limited, targeted intrusions against telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors; the report covers its multi-stage DLL sideloading and loaders, custom encrypted/compressed archives and executable format, WebSocket-based C2 protocol and commands, observed association with Storm-3069 (DAEMON Tools supply chain activity), indicators of compromise, hunting queries, and mitigation recommendations.