Loading story…
Microsoft identified NeedyMantis, a modular post-compromise malware framework selectively deployed against telecommunications organizations, universities, medical nonprofits, intergovernmental bodies, and government contractors since at least October 2025. At least one user is Storm-3069, the activity cluster associated with the DAEMON Tools supply-chain compromise. Microsoft assesses that the activity aligns with China-based operators, but has not attributed it to a Chinese nation-state or determined that all NeedyMantis activity originates from a single operator.
Attackers deploy NeedyMantis after gaining initial access, commonly using DLL sideloading with loaders disguised as legitimate libraries alongside applications including Poedit, curl, Vim, and TightVNC. The framework uses encrypted custom archives, shellcode loaders, a minimized custom executable format, obfuscation, anti-debugging, WebSocket command-and-control, and downloadable modules to maintain access and expand capabilities. Defenders should investigate traffic to corp.tripswithengine[.]com over HTTPS/WebSockets on port 443, particularly connections using the Firefox/21.0 user agent, and hunt for suspicious DLL paths, DLL sideloading, and post-compromise Impacket activity.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft observed the modular NeedyMantis post-compromise malware family being used in targeted intrusions since at least October 2025. Affected organizations included telecommunications firms, universities, medical nonprofits, intergovernmental organizations, and government contractors; at least one observed user was Storm-3069.
Microsoft documented NeedyMantis's custom archive and shellcode-based loading chain, plus encrypted WebSocket command-and-control; one observed configuration contacted corp.tripswithengine[.]com over port 443. Microsoft also said separate infections indicate the framework may be used or possessed by more than one operator.
In one observed intrusion, an operator used Impacket to copy legitimate software, a malicious masquerading DLL, and a NeedyMantis archive from a network share to a targeted device. The malware was deployed through DLL sideloading after the actor had established access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Microsoft reported a multi-stage malware campaign that used **WhatsApp messages** to trick targets into opening malicious **Visual Basic Script** (`.vbs`) files. The activity, observed from late February 2026, relied on social engineering and trusted cloud infrastructure including **AWS S3**, **Tencent Cloud**, and **Backblaze B2** to host follow-on payloads. After execution, the malware created hidden folders under `ProgramData`, downloaded additional VBS components, and used renamed legitimate Windows utilities to blend into normal system activity. The intrusion chain then attempted **UAC bypass**, registry changes for persistence, and deployment of unsigned MSI installers including `Setup.msi`, `WinRAR.msi`, `LinkPoint.msi`, and `AnyDesk.msi`, which provided remote access and backdoor capability on compromised systems. Microsoft said the attackers abused living-off-the-land techniques such as renaming `curl.exe` and `bitsadmin.exe` while leaving original PE metadata intact, giving defenders a detection opportunity; the company also linked the activity to command-and-control domains **`neescil.top`** and **`velthora.top`** and published indicators, file hashes, and hunting guidance for defenders.
Jun 29, 2026