Microsoft Links NeedyMantis Malware to Breached Networks

Microsoft detailed NeedyMantis, malware used since at least October 2025 to keep long-term access to breached networks at telecoms, universities, medical nonprofits, intergovernmental organizations and government contractors. It appeared in a small number of targeted intrusions and was found while following up on Kaspersky's DAEMON Tools supply chain attack investigation. Microsoft tracks one user as Storm-3069, assesses the activity likely originates in China, and published indicators of compromise.