NeedyMantis is built to maintain access after an intrusion

Microsoft described NeedyMantis on 28 September as a modular malware family observed in a limited number of targeted operations. Reported sectors included telecommunications, universities, medical nonprofits and government-related organisations. The company traces activity back to at least October 2025.

Researchers found the malware while following indicators related to a separate supply-chain investigation. They described encrypted packaging and extensible components used after an attacker already had access. Microsoft associated observed activity with actors operating from China but had not established that every case belonged to one operator. The distinction matters when interpreting an indicator: finding the same malware family can connect technical behaviour without settling who controlled a particular intrusion.