#needymantis — Public Fediverse posts

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Pulse ID: 6abac5fd70758a52b56cb48e
Pulse Link: https://otx.alienvault.com/pulse/6abac5fd70758a52b56cb48e
Pulse Author: AlienVault
Created: 2026-09-28 19:54:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#NeedyMantis #Malware #China #SideLoading #OTX #AlienVault

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Pulse ID: 6abac5fd70758a52b56cb48e
Pulse Link: https://otx.alienvault.com/pulse/6abac5fd70758a52b56cb48e
Pulse Author: AlienVault
Created: 2026-09-28 19:54:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#NeedyMantis #Malware #China #SideLoading #OTX #AlienVault

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Pulse ID: 6abac5fd70758a52b56cb48e
Pulse Link: https://otx.alienvault.com/pulse/6abac5fd70758a52b56cb48e
Pulse Author: AlienVault
Created: 2026-09-28 19:54:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#NeedyMantis #Malware #China #SideLoading #OTX #AlienVault

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Pulse ID: 6abac5fd70758a52b56cb48e
Pulse Link: https://otx.alienvault.com/pulse/6abac5fd70758a52b56cb48e
Pulse Author: AlienVault
Created: 2026-09-28 19:54:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#NeedyMantis #Malware #China #SideLoading #OTX #AlienVault

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Pulse ID: 6abac5fd70758a52b56cb48e
Pulse Link: https://otx.alienvault.com/pulse/6abac5fd70758a52b56cb48e
Pulse Author: AlienVault
Created: 2026-09-28 19:54:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#NeedyMantis #Malware #China #SideLoading #OTX #AlienVault