Microsoft Details NeedyMantis Windows Backdoor: DLL Sideloading Detection and Hunting

NeedyMantis is not a mass-market infostealer, and home PCs are unlikely targets. If you run security for a telecom provider, a university, a medical nonprofit, an intergovernmental body or a government contractor, you should read this.

What Microsoft found​

Microsoft says NeedyMantis activity goes back to at least October 2025. The oldest indicator in its IOC table is an archive hash first seen on October 3, 2025. The malware has appeared in a small number of highly targeted intrusions involving telecommunications providers, universities, medical nonprofits, intergovernmental bodies, and government contractors.

The family was found by accident. Researchers discovered NeedyMantis while pivoting from indicators linked to the DAEMON Tools supply-chain compromise, tracked by Microsoft as Storm-3069.

Microsoft is careful about attribution:

• Storm-3069 is the only actor Microsoft has confirmed using NeedyMantis so far.
• Microsoft assesses Storm-3069 as China-based activity but has not attributed it to a specific Chinese state-sponsored group.
• Separate NeedyMantis infections also suggest that more than one operator may possess the malware. Microsoft says it has not determined whether one actor or several are behind all the observed activity.
• Microsoft bases the China link on targeting that fits Chinese interests and on the selective way the malware is deployed.

Cyber Security News described the activity as long-term espionage-oriented access rather than indiscriminate cybercrime. That is a reasonable reading of the victim list, but it is the outlet's interpretation. Microsoft itself talks about long-term access and "follow-on operations" and does not state a motive.

Section summary: NeedyMantis is a selectively deployed persistence tool. Microsoft links it to China-based activity with stated caveats, and it has been tracked since at least October 2025.

The DAEMON Tools connection, and its limits​

The DAEMON Tools link is the easiest part of this story to get wrong.

Kaspersky's report from May 2026 found that official DAEMON Tools Lite installers had been trojanized starting April 8, 2026. The affected versions were 12.5.0.2421 through 12.5.0.2434. The malicious installers came from the vendor's legitimate website and carried the developer's own signatures. Kaspersky later updated its report to say the vendor had released version 12.6.0.2445, which no longer contains the malicious behavior. Kaspersky saw thousands of infection attempts in more than 100 countries, but only about a dozen machines received the more advanced follow-on backdoor.

Microsoft's position is narrower. It says it has not seen NeedyMantis itself delivered through a supply chain compromise. Storm-3069 is associated with the DAEMON Tools campaign, and a supply chain compromise is one way an attacker could get the foothold needed to deploy NeedyMantis. That is all Microsoft claims.

Practical takeaway: Kaspersky's advice for any machine that ran an affected DAEMON Tools build is to look for abnormal activity on or after April 8 and to update to 12.6.0.2445 or later. Updating does not remove anything an attacker already installed. A clean DAEMON Tools install does not mean NeedyMantis is absent, and NeedyMantis activity does not prove DAEMON Tools was the way in.

Section summary: The two threats share an actor designation and investigative roots. Microsoft has not established a delivery link between them.

How it gets onto a Windows machine​

NeedyMantis is written in C++ and x64 shellcode. Every deployment starts with two files placed next to a legitimate application:

1. A first-stage loader DLL that pretends to be a DLL the application needs.
2. An encrypted archive with the same name as the DLL, minus the extension.

When the legitimate application runs, Windows loads the malicious DLL instead of the real one. This is standard DLL sideloading. Microsoft lists the following host applications and disguises:

In one incident, an operator doing hands-on-keyboard work used Impacket to copy the legitimate software, the malicious DLL and the archive from a network share, then ran them on the target. That shows the attacker already had working credentials and lateral movement before NeedyMantis arrived.

Some analysis based on general Windows knowledge:

• %ProgramData%\USOShared is a folder that Windows' Update Session Orchestrator uses. A libcurl.dll in that folder should be treated as suspicious.
• The Poedit entry is harder. A normal Poedit install includes a genuine WinSparkle.dll, the update component the malware replaces. Microsoft's own description of the hunting query calls these "legitimate, unmodified application folders". A match on file name alone could just be a real install. Check the hash and signature before escalating.

Inside the malware​

Stage one: the sideloaded loader​

In Microsoft's analyzed sample, the loader posed as Poedit's WinSparkle updater. It has one job: extract and launch the second stage. It hides most of its strings and constants using obfuscated stack strings, which are assembled piece by piece on the stack and then decoded with arithmetic. It looks up Windows APIs at runtime, and it uses two anti-debugging checks, one based on ProcessDebugFlags and one on ThreadHideFromDebugger.

The custom archive​

The archive is XOR-encoded and compressed with the Windows RtlDecompressBuffer routine. Each file inside it is encoded the same way. Offsets and XOR keys change from sample to sample, so static signatures written for one archive will not reliably match the next.

The WinSparkle archive held 11 files. Several were legitimate decoys: 7-Zip components, the Sysinternals Disk2vhd and Ctrl2Cap components, and a real kernel32.dll. The four malicious entries were disguised as familiar names:

• encryptbase64.ps1: the second-stage loader. Despite the PowerShell extension, it contains x64 shellcode.
• dnsapi.dll: the configuration file.
• ws2_32.dll: a WebSockets communications library.
• msvcrt140.dll: shellcode that loads module DLLs and resolves their exports.

An older archive named libcurl contained just four files, including a persistence module that uses Windows Services. Microsoft documents that module only for the older archive, so do not assume every current sample installs a service.

Stage two and the main component​

The second-stage loader resolves APIs with a rotate-right hash (the sample used a rotation value of 11). It then decodes and decompresses the main component, which is stored in a stripped-down, PE-like custom executable format. Standard PE parsers will struggle with it.

The main component creates a mutex named <username>-<process name>. Microsoft's example is Contoso-Poedit.exe. Its configuration contains:

• C2 host corp.tripswithengine[.]com on port 443
• URI /library/zip/
• Empty proxy credential fields
• Sleep-related values of 300

Command and control​

The first beacon is an HTTPS GET request. System details are packed into the Set-Cookie header, Base64-encoded and compressed: computer name, username, process name, parent process, the contents of Program Files and a process list. The connection then switches to WebSockets and a custom binary protocol:

• 44-byte header, XOR-encoded with a random 16-byte key.
• Payloads compressed with RtlCompressBuffer, optionally encrypted with RC4.
• Key exchange: the client generates a random 1,024-byte buffer and uses its first 32 bytes as the RC4 key. It encrypts a 256-byte check buffer that begins with google.com and sends the key material in a message that is compressed but not encrypted. The key therefore travels alongside the data it protects. Microsoft says the server "presumably" verifies the check buffer, so that detail is an inference, not a confirmed behavior.

The communications DLL uses WinINet with a hard-coded user agent of firefox/21.0. Firefox 21 dates from 2013, so that string should stand out in modern proxy logs. A second version uses Libwebsockets instead and keeps the same internal API.

The command set is small:

• Sent to C2: 1110 (computer and user name), 1112 (hard-coded ID such as 20001), 1150 (keep-alive)
• Received from C2: 1020 (load module), 1030 (unload module), 1050/1150 (send data to a module), 1070 (turn off active flags)

The real capabilities live in downloadable modules. Microsoft says what those modules can do remains unconfirmed. Defenders know how the framework loads and runs modules, but not what the modules contain.

Detection and hunting for Microsoft shops​

Microsoft Defender detections named in the report:

• TrojanDropper:Win64/NeedyMantis
• Behavior:Win64/NeedyMantis
• HackTool:Win32/Impacket
• Defender for Endpoint alerts for suspicious DLL loads, unexpected DLL loads by executables, suspicious decode commands, Impacket activity and emerging threat actor TTPs

Defender detections include TrojanDropper:Win64/NeedyMantis, Behavior:Win64/NeedyMantis, and alerts for suspicious sideloading or Impacket activity.

Microsoft's hunting guidance, in plain terms:

1. File hunting: search DeviceFileEvents for the path and DLL name pairs in the table above. Include both the Program Files and Program Files (x86) variants for Poedit and the "modifiable" NVIDIA folder.
2. Network hunting: search network, URL-click, email URL and file and process events for corp.tripswithengine.com. Microsoft's queries cover the past seven days. Widen the window if your retention allows, since the activity goes back to 2025.
3. User-agent hunting: search network events and Sentinel CommonSecurityLog data for Firefox/21.0.
4. Sentinel TI Map: deploy the TI Mapping analytics through the Threat Intelligence solution in Content Hub so domain indicators match automatically.

A minimal starting query for the domain:

DeviceNetworkEvents
| where RemoteUrl has "tripswithengine.com"

Published indicators (SHA-256):

• e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e: loader WinSparkle.dll (seen May 21, 2026)
• 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef: WinSparkle archive (seen May 23, 2026)
• c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77: older libcurl archive (seen October 3, 2025)
• corp.tripswithengine[.]com: C2 host

Be careful with these IOCs. Archive keys and offsets change per sample, and the file names are chosen per deployment. A clean hash sweep proves little. Hunting for behavior (unexpected DLL loads from ProgramData, the old Firefox user agent, Impacket activity) will hold up longer.

Hardening checklist​

Microsoft's recommended mitigations, in a practical order:

1. Block and alert on outbound traffic to the C2 domain at the egress point.
2. Turn on cloud-delivered protection and Block at First Sight in Microsoft Defender Antivirus.
3. Run EDR in block mode, especially if Defender Antivirus is in passive mode behind another antivirus product.
4. Turn on network protection in Defender for Endpoint.
5. Set up automatic attack disruption in Defender XDR.
6. Evaluate two attack surface reduction (ASR) rules: block executable files unless they meet a prevalence, age or trusted-list criterion, and block execution of potentially obfuscated scripts. First check each rule's user impact in the threat and vulnerability management recommendation pane. Microsoft notes this shows what share of devices can take blocking mode without disrupting users.

This part is my own advice rather than Microsoft's: because NeedyMantis arrives after initial access, the best defenses come earlier. That means restricting admin shares and lateral-movement credentials that tools like Impacket abuse, and not letting standard users write to ProgramData subfolders that host application binaries.

The bottom line​

NeedyMantis introduces no new technique. DLL sideloading, stack-string obfuscation, API hashing and WebSockets C2 are all familiar. What makes it hard to catch is how the pieces combine: several loaders, per-sample archive keys, a non-standard executable format and a plug-in module system. For most Windows users the risk is low. For defenders in the targeted sectors, the useful steps right now are the DLL path list, the 2013-era Firefox user agent and the Impacket hunting leads. Microsoft has not said what the downloadable modules actually do.