Microsoft links NeedyMantis malware to the May 2026 Daemon Tools supply-chain attack targeting government and telecom organizations

Updated: 2026.09.29 21D ago 2 sources

Supply Chain Threat Actors & APTs Malware

Microsoft says the China-based attackers behind the May 2026 Daemon Tools supply-chain attack used a modular malware framework called NeedyMantis for follow-on intrusions. The malware was found after poisoned Daemon Tools installers from the official site infected thousands of systems and a backdoor was deployed on about a dozen. Microsoft says NeedyMantis uses DLL sideloading, encrypted archives, custom executable formats, WebSockets command-and-control, and modular C++ and x64 shellcode to maintain long-term access.

Why it matters: This matters because a trusted software distribution channel was used to seed targeted espionage-style access into sensitive organizations. Defenders that investigated the Daemon Tools incident should review Microsoft’s new indicators and hunting guidance, especially in government, telecom, research, and contractor environments.

Sources

'NeedyMantis' Provides Long-Term Access to Compromised Networks

Elizabeth Montalbano 2026.09.29 95% relevant

This article is a report on the same underlying event: Microsoft's disclosure of the NeedyMantis malware framework, its use for long-term post-compromise access, and its discovery during investigation of indicators tied to the May 2026 DAEMON Tools supply-chain compromise. It adds target sectors including telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors, plus detail that Microsoft associates some activity with China-based Storm-3069.

Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

Ionut Arghire 2026.09.29 100% relevant

The article establishes a distinct tracked story by adding the first detailed public technical analysis of the NeedyMantis malware framework used in the Daemon Tools supply-chain attack and its targeted follow-on operations.