other

Storm-3069

Microsoft's tracking designation for the threat activity behind the DAEMON Tools supply-chain compromise.

Current clusters

NeedyMantis was in targeted networks six months before DAEMON Tools installers were poisoned

Microsoft says intruders have used NeedyMantis, a sideloaded malware family, to hold access in a few targeted networks since at least October 2025. It has not seen the tool ship in the poisoned DAEMON Tools installers, so its indicators apply beyond that software's users.

Publishers:thehackernews.com

Reality

Evidence60
Adoption: Insufficient
Hype gap0
Incentives35
Confidence55

security1 publisher

Microsoft links post-compromise NeedyMantis malware to the DAEMON Tools supply-chain actor

Microsoft says China-aligned NeedyMantis malware, active since at least October 2025, is installed after attackers already have access, to keep it long term. Because entry routes vary, organisations in the five sectors it targets need to look for copies already installed.

Publishers:microsoft.com

Reality

Evidence55
Adoption: Insufficient
Hype gap0
Incentives40
Confidence60