<![CDATA[Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks]]>Microsoft has published a technical analysis of a malware family it tracks as NeedyMantis, used by attackers to keep a foothold in networks they had already compromised. Rather than serving as an initial access tool, the malware functions as a persistence mechanism, allowing intruders to retain long-term access to environments they had already breached.

The activity has so far been observed in a small number of targeted intrusions, with victims spanning several sectors:

  • Telecommunications organizations
  • Universities
  • Medical nonprofits
  • Intergovernmental organizations
  • Government contractors

According to Microsoft, the malware's use dates back to at least a period prior to its public disclosure, indicating the tooling has been in circulation for some time before coming to light.

For defenders, the key takeaway is that NeedyMantis is a post-compromise persistence tool, meaning its presence implies an environment was already accessed through other means. Detection efforts should therefore focus on hunting for signs of prolonged unauthorized access rather than treating the malware as a standalone initial infection vector.

Source: The Hacker News

Has anyone seen NeedyMantis-related activity in their environment, and how is your team approaching detection for long-term persistence tools?

]]>https://xploitlk.com/topic/502/hackers-use-needymantis-to-maintain-long-term-access-in-breached-networksRSS for NodeTue, 27 Oct 2026 08:16:02 GMTTue, 29 Sep 2026 06:30:26 GMT60