Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
-
Microsoft has published a technical analysis of a malware family it tracks as NeedyMantis, used by attackers to keep a foothold in networks they had already compromised. Rather than serving as an initial access tool, the malware functions as a persistence mechanism, allowing intruders to retain long-term access to environments they had already breached.
The activity has so far been observed in a small number of targeted intrusions, with victims spanning several sectors:
- Telecommunications organizations
- Universities
- Medical nonprofits
- Intergovernmental organizations
- Government contractors
According to Microsoft, the malware's use dates back to at least a period prior to its public disclosure, indicating the tooling has been in circulation for some time before coming to light.
For defenders, the key takeaway is that NeedyMantis is a post-compromise persistence tool, meaning its presence implies an environment was already accessed through other means. Detection efforts should therefore focus on hunting for signs of prolonged unauthorized access rather than treating the malware as a standalone initial infection vector.
Source: The Hacker News
Has anyone seen NeedyMantis-related activity in their environment, and how is your team approaching detection for long-term persistence tools?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login