NeedyMantis long-term access activity
Malware Activity
Summary
Hide ▲
Show ▼
The NeedyMantis malware family is being used to maintain long-term access in already breached networks, affecting a small number of targeted intrusions across telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors. Microsoft says the activity dates back to October 2025. In examined cases, the malware arrived through DLL sideloading and established command-and-control over HTTPS and WebSocket. Microsoft published SHA-256 hashes, the corp.tripswithengine[.]com domain, file paths, and hunting queries to help defenders find it.
Related Happenings
Antino Windows backdoor activity using Microsoft 365 dead drops
Malware Activity
H score15
First: 02.10.2026 20:33
Last: 02.10.2026 20:33
Sources 1
About this happening:
Antino is being deployed as a Windows backdoor that gives operators host reconnaissance, command execution, file transfer, and persistence while routing C2...
Antino Windows backdoor activity using Microsoft 365 dead drops
Malware ActivityAbout this happening: Antino is being deployed as a Windows backdoor that gives operators host reconnaissance, command execution, file transfer, and persistence while routing C2...
NeedyMantis persistent-access malware framework
Malware Activity
H score23
First: 29.09.2026 16:30
Last: 29.09.2026 16:30
Sources 1
How related:
Microsoft’s analysis of NeedyMantis suggested that it is only deployed after the threat actor has previously gained access to the compromised environment, therefore the malware is likely used to maintain long-term access and support follow-on operations.
About this happening:
The NeedyMantis malware framework is enabling persistent access inside compromised networks, giving attackers a hidden foothold for follow-on operations and data theft. It...
NeedyMantis persistent-access malware framework
Malware ActivityHow related: Microsoft’s analysis of NeedyMantis suggested that it is only deployed after the threat actor has previously gained access to the compromised environment, therefore the malware is likely used to maintain long-term access and support follow-on operations.
About this happening: The NeedyMantis malware framework is enabling persistent access inside compromised networks, giving attackers a hidden foothold for follow-on operations and data theft. It...
Silver Fox bogus software-download websites campaign
Campaign
H score38
First: 02.09.2026 19:41
Last: 02.09.2026 19:41
Sources 1
About this happening:
An active Silver Fox (aka Yinhu) campaign is using bogus software-download websites to impersonate trusted vendors and deliver malicious installers, exposing China-based...
Silver Fox bogus software-download websites campaign
CampaignAbout this happening: An active Silver Fox (aka Yinhu) campaign is using bogus software-download websites to impersonate trusted vendors and deliver malicious installers, exposing China-based...
ACR Stealer enterprise infostealer surge
Malware Activity
H score29
First: 18.07.2026 17:17
Last: 18.07.2026 17:17
Sources 1
About this happening:
ACR Stealer attacks surged against enterprise customers, putting browser-stored passwords, authentication tokens, cookies, and sensitive documents at risk....
ACR Stealer enterprise infostealer surge
Malware ActivityAbout this happening: ACR Stealer attacks surged against enterprise customers, putting browser-stored passwords, authentication tokens, cookies, and sensitive documents at risk....
ACR Stealer browser credential and document theft activity
Malware Activity
H score29
First: 17.07.2026 11:56
Last: 17.07.2026 11:56
Sources 1
About this happening:
ACR Stealer activity has expanded across enterprise environments, with Microsoft linking the malware to late April to mid-June 2026 campaigns that use ClickFix lur...
ACR Stealer browser credential and document theft activity
Malware ActivityAbout this happening: ACR Stealer activity has expanded across enterprise environments, with Microsoft linking the malware to late April to mid-June 2026 campaigns that use ClickFix lur...
Timeline
-
29.09.2026 16:30 1 articles · 13d ago
Microsoft details NeedyMantis DLL sideloading and China-linked activity
Technical Analysis UpdateMicrosoft said NeedyMantis has been active since at least October 2025 and is used against telecommunications providers, universities and government-linked organizations; the malware is deployed after initial access to maintain long-term access, is installed through DLL side-loading with legitimate software such as Poedit, curl, Vim and TightVNC, and Microsoft attributed the activity as emerging from China while noting at least one operator is Storm-3069.
Show sources
- Microsoft Warns NeedyMantis Malware Enables Persistent Network Access — www.infosecurity-magazine.com — 29.09.2026 16:30
-
28.09.2026 21:35 2 articles · 13d ago
NeedyMantis long-term access activity
Initial DisclosureThe earliest tracked NeedyMantis sample dates to October 2025, when an older version included a persistence module that used Windows services. Later samples seen in May 2026 led Microsoft to publish hashes, paths, domains, and hunting queries for defenders.
Show sources
- Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks — thehackernews.com — 28.09.2026 21:35
- Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks — thehackernews.com — 28.09.2026 21:35