Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

Microsoft analyzed a malware framework named NeedyMantis used by a China-based threat actor in attacks against telecommunications and governmental organizations. This framework was discovered during the analysis of indicators of compromise associated with the May 2026 Daemon Tools supply chain attack. Thousands of computers were infected via poisoned Daemon Tools iterations distributed through the official website, resulting in backdoors being deployed on approximately a dozen systems across Belarus, Russia, and Thailand.
NeedyMantis is a modular post-compromise malware employed to maintain long-term access following initial system compromise. It has been observed in targeted attacks against universities, government contractors, telecoms, and medical non-profit organizations. The framework utilizes a modular architecture including multiple loaders, custom encrypted file archives, and C++ and x64 shellcode components designed for evasion.
The infection chain begins with a first-stage loader that abuses DLL sideloading to execute a second-stage loader, which then runs the main malware component. This process extracts embedded data and decodes it into a minimized PE file format formatted as a custom DLL. The main component manages command-and-control (C&C) communication via 10 WebSockets functions and controls module loading and system data transmission based on received commands.

* Microsoft analyzed a malware framework called NeedyMantis used by a China-based threat actor.
* The framework was discovered during the follow-on analysis of indicators of compromise (IoCs) from the May 2026 Daemon Tools supply chain attack.
* Poisoned Daemon Tools iterations were distributed through an official website, infecting thousands of computers and deploying backdoors on roughly a dozen systems.
* Targeted attacks affected government, scientific, manufacturing, and retail organizations in Belarus, Russia, and Thailand.
* NeedyMantis is modular post-compromise malware used against universities, government contractors, telecoms, medical non-profit, and intergovernmental organizations.
* The malware was used in attacks since at least October 2025, likely by threat actors based in China.
* The hacking group behind the Daemon Tools attack, Storm-3069, has not been attributed to a Chinese nation-state actor according to Microsoft.
* NeedyMantis utilizes multiple loaders, custom encrypted file archives, and modular components in C++ and x64 shellcode for evasion.
* The infection chain involves a first-stage loader abusing DLL sideloading to execute a second-stage loader that extracts and runs the main malware component.
* The main component orchestrates C&C communication via 10 WebSockets functions and manages module operations based on remote commands.

The structure of NeedyMantis suggests a focus on persistence and layered evasion, where initial delivery is designed to be low-footprint while the post-compromise functionality grants deep operational control. The reliance on modular components in C++ and x64 shellcode points toward an intentional effort to maintain capability flexibility and complicate forensic analysis by employing custom file formats and obfuscated execution paths. The method of using DLL sideloading to chain loaders represents a classic technique for initial privilege escalation post-exploitation, ensuring the malware executes within the context of legitimate software.
The observation that the main component can load or unload modules implies an architecture designed not just for stealth, but for dynamic expansion of functionality tailored to specific environments. The ambiguity surrounding the confirmed capabilities of the resulting modules suggests a deliberate gap in public disclosure, serving as a mechanism for obfuscating true scope while maintaining operational efficacy. This pattern implies that actors prioritize sustained, deep access over immediate, brute-force impact.
The framing around attribution—where Microsoft explicitly notes the hacking group was not attributed to a nation-state actor despite the involvement of Chinese actors—highlights the tension between technical evidence and geopolitical narrative. This creates an environment where analyzing the observed technical behaviors must proceed independently of established political assumptions. The implications for agency rest on understanding that long-term access is the primary objective, shifting focus from preventing initial intrusion to monitoring and containing the persistence mechanisms established by frameworks like NeedyMantis across diverse sectors.
Bridge Questions:
If the observable functions are limited to command extension, what specific triggers or criteria dictate when modules are loaded versus unloaded? How does the use of custom executable formats affect the feasibility of automated detection systems designed for known PE structures? What is the long-term risk associated with environments where persistent access relies on post-compromise modularity rather than detectable initial execution artifacts?