other

NeedyMantis

Modular Windows malware family, named by Microsoft, that attackers install after gaining access to keep long-term control of a network.

Known aliases

Behavior:Win64/NeedyMantis
TrojanDropper:Win64/NeedyMantis

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

NeedyMantis was in targeted networks six months before DAEMON Tools installers were poisoned

Microsoft says intruders have used NeedyMantis, a sideloaded malware family, to hold access in a few targeted networks since at least October 2025. It has not seen the tool ship in the poisoned DAEMON Tools installers, so its indicators apply beyond that software's users.

Publishers:thehackernews.com

Reality

Evidence60
Adoption: Insufficient
Hype gap0
Incentives35
Confidence55

security1 publisher

Microsoft links post-compromise NeedyMantis malware to the DAEMON Tools supply-chain actor

Microsoft says China-aligned NeedyMantis malware, active since at least October 2025, is installed after attackers already have access, to keep it long term. Because entry routes vary, organisations in the five sectors it targets need to look for copies already installed.

Publishers:microsoft.com

Reality

Evidence55
Adoption: Insufficient
Hype gap0
Incentives40
Confidence60