Quick Takeaways
- NeedyMantis malware enables persistent, covert access to targeted networks through DLL sideloading using legitimate applications like Poedit and VNC.
- Attackers deploy NeedyMantis via encrypted archives that load malicious DLLs, connecting to a C2 server over HTTPS to potentially load additional modules.
- Indicators of compromise include specific SHA-256 file hashes, C2 domain corp.tripswithengine[.]com, and malicious DLL paths, with Microsoft recommending targeted detection and response actions.
Threat, Techniques, and Targets
Hackers are using a malware called NeedyMantis to keep access to networks they have already compromised. Microsoft has studied this malware closely. It has been involved in a small number of attacks. These attacks target telecommunications companies, universities, medical nonprofits, government agencies, and contractors. The activity dates back to at least October 2025. The hackers may gain initial access in different ways. After entry, they use NeedyMantis to stay hidden and maintain control.
The malware arrives as a bundle of three parts. First, a legitimate program such as Poedit, curl, Vim, or TightVNC. Second, a malicious DLL that loads with the program. Third, an encrypted archive with the same name as the DLL. When the program starts, it loads the malicious DLL. This process is called DLL sideloading. The malware then unpacks and runs the next stage. It connects to a command-and-control (C2) server over HTTPS and switches to a WebSocket. This allows hackers to send commands and modules or extract data from the network. The malware’s use on specific targets suggests it is part of a targeted campaign.
Impact, Implications, and Remediation
NeedyMantis helps hackers maintain long-term access to compromised networks. This can give them control over infected systems for data theft or further attacks. Its presence indicates a serious security risk. Detection involves checking for specific file hashes, domains, and file paths. Microsoft has provided indicators such as SHA-256 hashes, domain names, and user agents to help identify the malware. The malware is detected by Microsoft Defender as TrojanDropper:Win64/NeedyMantis.
If organizations find signs of infection, they should follow recommended security measures. These include enabling cloud-delivered protection, blocking malicious files at first sight, and using endpoint detection and response (EDR) in block mode. It is also important to monitor outbound connections to the known C2 domain. If there are suspicions of compromise, organizations should seek guidance from cybersecurity vendors or authorities for specific remediation steps. Microsoft states that the malware was not delivered through the DAEMON Tools installers but recommends uninstalling and scanning systems if the software was used during the attack period.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
