{
	"id": "7421f523-040c-4479-b0b8-dc5fb60b25c5",
	"created_at": "2026-10-13T02:02:37.762519Z",
	"updated_at": "2026-10-14T02:03:04.225145Z",
	"deleted_at": null,
	"sha1_hash": "1c57bb03602d044ec24ff2846bf52a41ab6d50b7",
	"title": "NeedyMantis: Unpacking a post-compromise malware family used in targeted operations",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 953907,
	"plain_text": "https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nNeedyMantis: Unpacking a post-compromise malware family used in\n\ntargeted operations\n\nBy Microsoft Threat Intelligence\n\nPublished: 2026-09-28 · Archived: 2026-10-13 02:00:42 UTC\n\nMicrosoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited\n\nnumber of targeted operations affecting telecommunications organizations, universities, medical nonprofits,\n\nintergovernmental organizations, and government contractors. Based on observed activity, NeedyMantis is typically\n\ndeployed after a threat actor has already established access to a target environment, indicating that the malware is used to\n\nmaintain long-term access and support follow-on operations.\n\nNeedyMantis activity dates back to at least October 2025. We discovered the malware family while analyzing and pivoting\n\nfrom research and indicators of compromise associated with the DAEMON Tools supply chain compromise, which\n\nKaspersky previously reported on as part of its investigation into the campaign. Observed activity involving NeedyMantis\n\nhas thus far aligned with activity that Microsoft associates with threat actors operating from China, although Microsoft has\n\nnot determined whether all observed activity is attributable to the same operator.\n\nWhile NeedyMantis employs techniques commonly used by modern malware, its architecture combines multiple loaders,\n\ncustom encrypted file archives, a custom executable file format, and modular components that enable operators to evade\n\nanalysis and extend functionality through additional modules. These characteristics, combined with its use in targeted\n\nintrusions, make NeedyMantis a useful case study for understanding how threat actors establish and maintain long-term\n\naccess within victim environments.\n\nIn this blog, we analyze the NeedyMantis malware framework. We examine its packaging and deployment, custom archive\n\nformat, loader architecture, command-and-control (C2) communications, and modular design. We also provide indicators of\n\ncompromise (IOCs), Microsoft Defender detections, and mitigation guidance to help organizations defend against this threat\n\nand related activity.\n\nObserved operators and targeting\n\nAt the time of writing, Microsoft has observed at least one threat actor using NeedyMantis malware: Storm-3069. Storm-\n\n3069 is Microsoft Threat Intelligence’s designator for activity associated with the DAEMON Tools supply chain\n\ncompromise. While Microsoft assesses the activity originates from China, it has not attributed Storm-3069 to a Chinese\n\nnation-state actor. Microsoft identified NeedyMantis through follow-on analysis of indicators associated with Kaspersky’s\n\ninvestigation of the DAEMON Tools compromise.\n\nMicrosoft has observed additional NeedyMantis activity beyond Storm-3069’s activity in the DAEMON Tools campaign,\n\nindicating that the malware might be used by more than one operator. Observed activity involving NeedyMantis has thus far\n\naligned with activity Microsoft associates with threat actors operating from China, such as targeting that aligns with Chinese\n\ninterests and the use of selective deployment.\n\nNeedyMantis has been observed in intrusions affecting telecommunications organizations, universities, intergovernmental\n\norganizations, medical nonprofits, and government contractors. Combined with the malware’s limited observed deployment\n\nand alignment with activity Microsoft associates with China-based threat actors, this victimology suggests NeedyMantis is\n\ndeployed selectively rather than broadly. However, Microsoft has not determined whether all observed activity is attributable\n\nto the same threat actor or whether multiple actors have access to the malware.\n\nPage 1 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nMalware packaging and distribution\n\nAs previously mentioned, observed activity suggests that the malware is typically deployed after a threat actor has\n\nestablished access to a target environment. As a result, the methods used to gain access before NeedyMantis is deployed may\n\nvary across intrusions.\n\nNeedyMantis is composed of multiple components written in C++ and x64 shellcode. The malware starts with a first-stage\n\nloader and a file archive. The loader and archive have been found packaged alongside legitimate software, with the first-\n\nstage loader–masquerading as a required DLL—being loaded through DLL sideloading.\n\nSome of the open-source, software abused by the malware include: Poedit (translation), curl (data transfer), Vim (text\n\neditor), and TightVNC (remote access). Microsoft has also observed NeedyMantis masquerading as Microsoft Office,\n\nBroadcom, Intel, and NVIDIA DLL components. The following is a list of some of the DLL path names used by the\n\nmalware:\n\n%ProgramFiles%\\Poedit\\WinSparkle.dll\n\n%ProgramData%\\USOShared\\libcurl.dll\n\n%ProgramData%\\VIM\\vim64.dll\n\n%ProgramData%\\TightVNC\\VIM\\vim64.dll\n\n%ProgramData%\\office\\dbghelp.dll\n\n%ProgramData%\\broadcom\\dbghelp.dll\n\n%ProgramData%\\Intel\\jli.dll\n\n%ProgramFiles%\\modifiable\\nvml.dll\n\n%ProgramData%\\ics\\nvml.dll\n\nThe malware’s file archive is named the same as the loader DLL without the extension, for example WinSparkle or libcurl.\n\nIn one observed incident, an operator used the Impacket toolkit during hands-on-keyboard activity to copy the legitimate\n\nsoftware, malicious DLL, and file archive from a network share and execute it on a targeted device. This activity occurred\n\nafter the actor had already obtained access to the environment and illustrates one method by which NeedyMantis can be\n\nintroduced during an intrusion post-compromise.\n\nNeedyMantis is observed during the post-compromise stage of an intrusion after an actor has established access to the target\n\nenvironment. While one known user of the malware, Storm-3069, has been associated with supply chain compromises,\n\nMicrosoft has not observed NeedyMantis itself being distributed through a supply chain compromise. However, supply\n\nchain activity remains one possible means by which an actor could gain the access necessary to deploy the malware.\n\nNeedyMantis architecture and capabilities\n\nFirst-stage loader\n\nNeedyMantis’ first-stage loader is DLL sideloaded and launched when the legitimate software it is packaged with is run. Its\n\nonly task is to extract the second-stage loader from its file archive and continue execution there.\n\nIn the analyzed sample, the loader DLL was named WinSparkle.dll (SHA-256:\n\ne842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e) and its file archive was named WinSparkle\n\n(SHA-256: 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef). NeedyMantis spoofed and\n\nreplaced the WinSparkle software update component of the Poedit translation software.\n\nThe loader employs common anti-analysis techniques to hinder analysis, like obfuscating most of its important strings.\n\nPage 2 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nFigure 1. Example obfuscated strings being deobfuscated\n\nThis technique is known as obfuscated stack strings because each piece of the string is built up one at a time on the\n\nfunction’s stack. Once built up, it is deobfuscated using various mathematical operations. Most of the obfuscated strings in\n\nthis loader are Windows DLL and API names. These deobfuscated strings are used to resolve Windows APIs dynamically at\n\nruntime.\n\nIn addition to obfuscated strings, a lot of the code’s constant values are stored obfuscated as well.\n\nFigure 2. Example obfuscated constant value “1032” being deobfuscated\n\nFinally, the loader has two anti-debugger methods: one based on ProcessDebugFlags and the other using\n\nThreadHideFromDebugger.\n\nAs noted above, the loader’s main objective is to extract the next stage from its file archive and launch it. In the analyzed\n\nsample, the next stage was named encryptbase64.ps1.\n\nCustom file archives\n\nNeedyMantis’ file archives are in an encrypted and compressed custom file format. To get access to the files, the outer layer\n\nof the archive is XOR-decoded and RtlDecompressBuffer decompressed. Once decompressed, there are individual file\n\nentries. In each file entry, the file’s name is XOR-decoded and its contents are RtlDecompressBuffer decompressed.\n\nThe file format’s offsets, XOR keys, and values change from sample to sample.\n\nPage 3 of 14\n\nThis archive contains the following 11 files:\n\n7-zip.chm – Legitimate component of 7-Zip\n\n7-zip.dll – Legitimate component of 7-Zip\n\n7-zip32.dll – Legitimate component of 7-Zip\n\n7z.exe – Legitimate component of 7-Zip\n\nDisk2vhd.dll – Legitimate Sysinternals component Disk2vhd\n\nmain.dll – Legitimate Sysinternals component Ctrl2Cap\n\nkernel32.dll – Legitimate kernel32.dll\n\nencryptbase64.ps1 – Second-stage loader\n\ndnsapi.dll – Not a dnsapi.dll, but contains the malware’s configuration\n\nws2_32.dll – Not a ws2_32.dll, but contains a WebSockets based communications DLL\n\nremaining files, discussed below.\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nFigure 3. Example output of an archive unpacking tool displaying metadata of the WinSparkle file archive\n\nmsvcrt140.dll – Not a msvcrt140.dll, but contains shellcode to load module DLLs and resolve exports\n\nWhile this archive contains several legitimate software components, the malware’s functionality is implemented by the\n\nOther analyzed NeedyMantis file archives have contained different file names and components. An older version of the\n\nmalware, for example, used a libcurl (SHA-256: c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77)\n\nfile archive, and it contained only four files:\n\n300.c – Malware’s configuration\n\n300.s – WebSockets-based communications DLL\n\nis – Persistence module using Windows Services\n\nm.l – Main component\n\nPage 4 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nSecond-stage loader\n\nIn the analyzed sample, encryptbase64.ps1 was the second-stage loader. Despite its .ps1 PowerShell extension, the file\n\ncontains x64 shellcode. Its purpose is to decode and decompress an embedded binary which is NeedyMantis’ main\n\ncomponent.\n\nThis loader also has some anti-analysis functionality that differs from stage one. For string decoding, it locates two encoded\n\nblocks of data and XOR keys at calculated offsets and then decodes them. The first block, most relevantly, contains a few\n\nWindows DLL and API names that are resolved dynamically. The second block, shown below, contains a list of Windows\n\nDLL names and Windows API hash values:\n\nFigure 4. Decoded Windows API hash values\n\nThe component uses a rotate right (ROR) based algorithm with a configurable rotation value (the analyzed sample used\n\nvalue 11) to resolve these Windows API hashes. Figure 5 shows a snippet of Python code reproducing the algorithm:\n\nFigure 5. Python snippet of Windows API hashing algorithm\n\nThis second-stage loader’s objective is to extract embedded data, XOR-decode it, and then RtlDecompressBuffer\n\ndecompress it. The location of the encoded data and XOR key are at calculated offsets, which change from sample to\n\nsample.\n\nOnce decoded the resulting data is a DLL that has been formatted using a custom executable file format. It is a minimized\n\nversion of a PE file.\n\nPage 5 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nFigure 6. Example output of custom executable file format to PE file conversion tool\n\nMain component\n\nNeedyMantis’ main component orchestrates C2 communications and handles additional downloaded modules.\n\nIt creates a mutex named \u003cusername\u003e-\u003cprocess name\u003e, such as Contoso-Poedit.exe. Like in the first-stage loader, most of\n\nthe main component’s strings and constant values are stored as obfuscated stack strings.\n\nConfiguration\n\nThe malware’s configuration was stored in a dnsapi.dll file from the custom file archive. This file name spoofs a Windows\n\nnetworking library. In the sample analyzed, the file contains a 3448-byte binary structure. The structure includes the\n\nfollowing fields:\n\n0x00: Unknown (config contained “300”, but components also reference “400”)\n\n0x1c: Communication component name (ws2_32.dll)\n\n0x128: C2 port (443)\n\n0x12c: C2 host (corp.tripswithengine[.]com)\n\n0x334: C2 URI (/library/zip/)\n\n0x53C: WinHttpOpen AccessType (0)\n\n0x954: Proxy username (not set)\n\n0xB5C: Proxy password (not set)\n\n0xD64: Sleep time related (300)\n\n0xD68: Sleep time related (300)\n\nCommunications DLL\n\nAs referenced in the configuration, NeedyMantis makes use of a communication component called ws2_32.dll. This\n\ncomponent is also stored in the custom file archive. Like the config file, the file name spoofs a Windows networking library.\n\nPage 6 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nThis communications DLL has one export named SystemInfo. As shown below in Figure 7, SystemInfo exposes 10 functions\n\nfor the main component to initiate and maintain a WebSockets connection with the C2:\n\nFigure 7. Communications DLL API functions\n\nThe library uses WinINet APIs for WebSockets. It also has a hard-coded user-agent of firefox/21.0.\n\nWe have also spotted a second version of the communications DLL in a file archive. It implements the same\n\ncommunications API but uses Libwebsockets (LWS) instead of WinINet.\n\nCommand and control\n\nThe initial C2 beacon is an HTTPS GET request, similar to Figure 8 below:\n\nFigure 8. Initial C2 HTTPS GET request\n\ndecompressed. Once decompressed it contains a JSON object. The key values are:\n\nc – Computer name\n\nu – Username\n\no – Base64-encoded data, once decoded it contains line separated “: ” entries\n\np – Process name\n\npa – Parent process\n\nf – Files in ProgramFiles directory\n\np – Process list\n\na header and optional data components. The 44-byte header includes the following fields:\n\n0x00: 16-byte XOR key\n\n0x10: Uncompressed data length\n\n0x14: Compressed data length\n\nThe Set-Cookie header contains system information. The header value can be Base64-decoded and RtlDecompressBuffer\n\nThe connection is then converted to WebSockets and a binary C2 protocol is continued. The binary protocol is separated into\n\nPage 7 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\n0x18: Command number\n\n0x28: Data length\n\n0x2c: Optional data\n\nA 16-byte random XOR key is generated and the header is XOR-encoded, starting at offset 0x18. If there is any data, it is\n\ncompressed with RtlCompressBuffer and optionally encrypted with RC4.\n\nThe initial messages of the binary protocol are a key exchange with the C2 server. The protocol is performed as such:\n\n32-bytes are received from the C2 server, but then ignored\n\nA 1024-byte random buffer is created\n\nThe first 32-bytes of this random buffer are used as the RC4 key for further communications\n\nA 256-byte buffer is created that starts with google.com followed by random bytes\n\nThe 256-byte buffer is RC4 encrypted\n\nA random length between 292 and 1282 is picked\n\nThe C2 protocol message data is structured as such:\n\n0x00: The random length\n\n0x04: RC4 encrypted google.com buffer\n\n0x104: The random 1024-byte buffer used to create the RC4 key (at least 32 bytes of it)\n\nThis message data is compressed, but not RC4 encrypted\n\nA random command number between 1 and 45 is chosen\n\nThe C2 server uses the buffer at offset 0x104 to recreate the RC4 key and presumably checks the RC4 encrypted\n\ngoogle.com buffer\n\nThe server sends back the random command number as an acknowledgement\n\nCommands\n\nThe main component only has a handful of commands. Commands sent to the C2 include:\n\n1110 – Sends computer name and username\n\n1112 – Sends a hard-coded identifier (like 20001)\n\n1150 – Keep alive\n\nCommands received from the C2 include:\n\n1020 – Load module\n\n1030 – Unload module\n\n1050 / 1150 – Dispatch data to module\n\n1070 – Turn off active flags\n\nThe main component’s load, unload, and data dispatch commands show that NeedyMantis can extend its functionality\n\nthrough additional modules, but the capabilities of those modules remain unconfirmed.\n\nMitigation and protection guidance\n\nMicrosoft recommends the following mitigations to reduce the impact of this threat.\n\nLook for outbound connections in network egress traffic to corp.tripswithengine[.]com.\n\nTurn on cloud-delivered protection and block at first sight to rapidly identify and block new and unknown malware\n\nvariants.\n\nRun Endpoint Detection and Response (EDR) in block mode so that Microsoft Defender for Endpoint can block\n\nmalicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender\n\nPage 8 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nAntivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts\n\nthat are detected post-breach.\n\nEnable network protection in Microsoft Defender for Endpoint.\n\nConfigure automatic attack disruption in Microsoft Defender XDR. Automatic attack disruption is designed to\n\ncontain attacks in progress, limit the impact on an organization’s assets, and provide more time for security teams to\n\nremediate the attack fully.\n\nMicrosoft Defender XDR customers can turn on the following attack surface reduction rules to prevent common\n\nattack techniques used by threat actors.\n\nBlock executable files from running unless they meet a prevalence, age, or trusted list criterion\n\nBlock execution of potentially obfuscated scripts\n\nYou can assess how an attack surface reduction rule might impact your network by opening the security recommendation for\n\nthat rule in threat and vulnerability management. In the recommendation details pane, check the user impact to determine\n\nwhat percentage of your devices can accept a new policy enabling the rule in blocking mode without adverse impact to user\n\nproductivity.\n\nMicrosoft Defender detections\n\nMicrosoft Defender customers can refer to the list of applicable detections below. Microsoft Defender coordinates detection,\n\nprevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against\n\nattacks like the threat discussed in this blog.\n\nTactic\n\nExecution\n\nExecution\n\nExecution\n\nCommand and\n\ncontrol\n\nMicrosoft Security Copilot\n\nObserved activity\n\nShellcode loading, DLL\n\nsideloading, decryption, and\n\ndecompression\n\nHands-on-keyboard leveraging\n\nImpacket tool for follow-on\n\nactivity\n\nStorm-3069 threat actor TTPs\n\nNetwork connectivity to\n\nNeedyMantis infrastructure\n\nMicrosoft Defender coverage\n\nMicrosoft Defender for Endpoint\n\n– Suspicious DLL loaded\n\n– An executable file loaded an unexpected DLL\n\nfile\n\n– Suspicious decode command\n\nMicrosoft Defender Antivirus\n\n– TrojanDropper:Win64/NeedyMantis\n\nMicrosoft Defender for Endpoint\n\n– Ongoing hands-on-keyboard attack via\n\nImpacket toolkit\n\n– Impacket toolkit\n\n– Impacket module execution\n\nMicrosoft Defender Antivirus\n\n– HackTool:Win32/Impacket\n\nMicrosoft Defender for Endpoint\n\n– Suspicious activity linked to an emerging threat\n\nactor has been detected\n\nMicrosoft Defender Antivirus\n\n– Behavior:Win64/NeedyMantis\n\nPage 9 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nMicrosoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to\n\nsummarize incidents, analyze files and scripts, summarize identities, use guided responses, and generate device summaries,\n\nhunting queries, and incident reports.\n\nCustomers can also deploy AI agents, including the following Microsoft Security Copilot agents, to perform security tasks\n\nefficiently:\n\nThreat Intelligence Briefing agent\n\nPhishing Triage agent\n\nThreat Hunting agent\n\nDynamic Threat Detection agent\n\nSecurity Copilot is also available as a standalone experience where customers can perform specific security-related tasks,\n\nsuch as incident investigation, user analysis, and vulnerability impact assessment. In addition, Security Copilot offers\n\ndeveloper scenarios that allow customers to build, test, publish, and integrate AI agents and plugins to meet unique security\n\nneeds.\n\nThreat intelligence reports\n\nMicrosoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license\n\nfor at least one Defender XDR product) to get the most up-to-date information about the threat actor, malicious activity, and\n\ntechniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions\n\nto prevent, mitigate, or respond to associated threats found in customer environments.\n\nTool profile: NeedyMantis\n\nActor profile: Storm-3069\n\nTool profile: Impacket\n\nMicrosoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat\n\nIntelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal\n\nto get more information about this malware and associated activity.\n\nHunting queries\n\nMicrosoft Defender XDR\n\nMicrosoft Defender XDR customers can run the following advanced hunting queries to find related activity in their\n\nnetworks:\n\nNeedyMantis masquerading as software\n\nA listing of legitimate, unmodified application folders, along with malicious replacement DLL filenames sideloaded by\n\nNeedyMantis.\n\nDeviceFileEvents\n\n| where Timestamp \u003e ago(7d)\n\n| where (\n\n(FolderPath matches regex @\"^[A-Za-z]:\\\\Program Files\\\\Poedit\" and FileName == \"WinSparkle.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\Program Files \\(x86\\)\\\\Poedit\" and FileName ==\n\n\"WinSparkle.dll\")\n\nPage 10 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\USOShared\" and FileName == \"libcurl.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\VIM\" and FileName == \"vim64.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\TightVNC\\\\VIM\" and FileName == \"vim64.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\office\" and FileName == \"dbghelp.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\broadcom\" and FileName == \"dbghelp.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\Intel\" and FileName == \"jli.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\Program Files\\\\modifiable\" and FileName == \"nvml.dll\")\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\Program Files \\(x86\\)\\\\modifiable\" and FileName ==\n\n\"nvml.dll\")\n\n)\n\n| project Timestamp, DeviceId, DeviceName, ActionType, FolderPath, FileName,\n\nSHA1, SHA256, MD5,\n\nInitiatingProcessAccountUpn,\n\nInitiatingProcessCreationTime,\n\nReportId, TenantId\n\nNeedyMantis C2\n\nDeviceProcessEvents)\n\n\"corp.tripswithengine.com\"\n\n| where Timestamp \u003e ago(7d)\n\n| extend SourceTable = $table\n\n| project Timestamp,\n\nDeviceName,\n\nInitiatingProcessAccountName,\n\nInitiatingProcessAccountUpn,\n\nAccountName,\n\nor (FolderPath matches regex @\"^[A-Za-z]:\\\\ProgramData\\\\ics\" and FileName == \"nvml.dll\")\n\nInitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountSid,\n\nInitiatingProcessMD5, InitiatingProcessSHA1, InitiatingProcessSHA256,\n\nInitiatingProcessFolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine,\n\nThis query identifies connectivity to the NeedyMantis command and control site for this activity.\n\nsearch in (DeviceNetworkEvents, EmailUrlInfo, UrlClickEvents, DeviceEvents, DeviceFileEvents,\n\nPage 11 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nAccountUpn,\n\nRemoteIP,\n\nLocalIP,\n\nIPAddress,\n\nRemoteUrl,\n\nUrl,\n\nUrlDomain,\n\nFileOriginUrl,\n\nFileOriginReferrerUrl,\n\nFileOriginIP,\n\nProcessCommandLine,\n\nInitiatingProcessCommandLine,\n\nInitiatingProcessFileName,\n\nFileName,\n\nFolderPath,\n\nNetworkMessageId,\n\nSourceTable\n\nNeedyMantis communications DLL hard-coded user-agent\n\n\"Firefox/21.0\"\n\nIdentify connectivity utilizing the NeedyMantis hard-coded user-agent.\n\nsearch in (DeviceNetworkEvents, DeviceEvents, UrlClickEvents, EmailUrlInfo)\n\n| where Timestamp \u003e ago(7d)\n\n| extend SourceTable = $table\n\n| project Timestamp,\n\nDeviceName = iff(isnull(DeviceName), \"\", DeviceName),\n\nAccountUpn = coalesce(InitiatingProcessAccountUpn, AccountUpn, \"\"),\n\nAccountName = coalesce(InitiatingProcessAccountName, AccountName, \"\"),\n\nRemoteIP = coalesce(RemoteIP, IPAddress, \"\"),\n\nUrl = coalesce(RemoteUrl, Url, \"\"),\n\nUserAgent = AdditionalFields,\n\nPage 12 of 14\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nSourceTable\n\nMicrosoft Sentinel\n\nMicrosoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to\n\nautomatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map\n\nanalytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel\n\nNeedyMantis C2\n\nsearch in (CommonSecurityLog, SecurityEvent, AzureDiagnostics)\n\n\"corp.tripswithengine.com\"\n\n| where TimeGenerated \u003e ago(7d)\n\n| project TimeGenerated,\n\nDeviceName,\n\nComputer,\n\nSourceIP,\n\nSourcePort,\n\nSourceUserName,\n\nDestinationIP,\n\nDestinationPort,\n\nDestinationHostName,\n\nDestinationDnsDomain,\n\nRequestURL,\n\nProcessName,\n\nDestinationUserName,\n\nSourceHostName,\n\nMessage,\n\n$table\n\nNeedyMantis communications DLL hard-code user-agent\n\nIdentify connectivity utilizing the NeedyMantis hard-code user-agent.\n\nCommonSecurityLog\n\n| where TimeGenerated \u003e ago(7d)\n\nContent Hub to have the analytics rule deployed in their Sentinel workspace.\n\nThis query identifies connectivity to the NeedyMantis command and control site for this activity.\n\nPage 13 of 14\n\n| where RequestClientApplication contains \"Firefox/21.0\" or Message contains \"Firefox/21.0\"\n\n| project TimeGenerated, DeviceName, SourceUserName, SourceIP, DestinationIP, RequestURL,\n\nRequestClientApplication\n\nIndicators of compromise\n\nIndicator\n\ne842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e\n\n9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef\n\nc82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77\n\ncorp.tripswithengine[.]com\n\nReferences\n\nhttps://securelist.com/tr/daemon-tools-backdoor/119654/\n\nhttps://winsparkle.org/\n\nhttps://poedit.com/\n\nLearn more\n\nIntelligence Blog.\n\nand Bluesky.\n\nlisten to the Microsoft Threat Intelligence podcast.\n\ns/\n\nFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat\n\nTo hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape,\n\nhttps://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/\n\nFirst Las\nType Description\nseen seen\n\nFirst-stage\nSHA- 2026- 2026\nloader\n256 05-21 05-2\nWinSparkle.dll\n\nCustom file\nSHA- 2026- 2026\narchive\n256 05-23 05-2\nWinSparkle\n\nSHA- Custom file 2025- 202\n\n256 archive libcurl 10-03 10-0\n\nHost\nC2 host name\nname\n\nTo get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter),\n\nSource: https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operation\n\nPage 14 of 14",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/"
	],
	"report_names": [
		"needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations"
	],
	"threat_actors": [],
	"ts_created_at": 1791856957,
	"ts_updated_at": 1791943384,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1c57bb03602d044ec24ff2846bf52a41ab6d50b7.pdf",
		"text": "https://archive.orkl.eu/1c57bb03602d044ec24ff2846bf52a41ab6d50b7.txt",
		"img": "https://archive.orkl.eu/1c57bb03602d044ec24ff2846bf52a41ab6d50b7.jpg"
	}
}