Microsoft Warns NeedyMantis Malware Enables Persistent Network Access

Microsoft Threat Intelligence reports on NeedyMantis, a stealthy multi-stage malware framework active since at least October 2025 that has been used in targeted campaigns against telecommunications providers, universities, and government-linked organizations. The malware is deployed post-compromise by attackers who install components that use DLL side-loading (packaged with legitimate open-source tools) and include anti-analysis measures; later stages provide command-and-control, persistence, and data-exfiltration capabilities. Microsoft links the activity to operators emerging from China (including Storm-3069), warns of possible supply-chain vectors, and recommends enabling cloud-delivered protection, EDR in block mode, network protection, and automatic attack disruption in Defender XDR.