Microsoft details NeedyMantis malware linked to 2026 Daemon Tools supply-chain attack

Microsoft has published a deeper analysis of NeedyMantis, the malware framework tied to the May 2026 Daemon Tools supply-chain attack, outlining how the tool is used to hold access inside victim environments and support later operations. SecurityWeek reported that the framework emerged from Microsoft’s follow-on analysis of indicators connected to that Daemon Tools incident, which reportedly spread poisoned versions of the software through the official website and infected thousands of computers, with a backdoor deployed on roughly a dozen systems (SecurityWeek).

Microsoft describes NeedyMantis as a post-compromise framework, meaning it is typically used after an attacker has already gotten into a target environment. In Microsoft’s characterization, the malware is meant to preserve long-term access and enable follow-on activity rather than serve as the initial break-in tool (SecurityWeek). SecurityWeek also reported that Microsoft has observed NeedyMantis in attacks dating back to at least October 2025.

How NeedyMantis works

According to Microsoft’s analysis as reported by SecurityWeek, NeedyMantis is built as a modular framework with multiple loaders, custom encrypted file archives, custom executable file formats, and components written in C++ and x64 shellcode. That design appears intended to evade detection while giving operators room to extend the malware’s capabilities as needed (SecurityWeek).

Microsoft says the infection chain begins with a first-stage loader and a file archive packaged alongside legitimate software. The malware then abuses DLL sideloading to run that loader, which extracts and launches a second-stage loader before executing the main malware component (SecurityWeek).

The main component, Microsoft says, handles command-and-control communications through functions designed to establish and maintain a WebSockets connection. It can also send system and user information back to operators and respond to commands that load or unload modules, dispatch data to those modules, and disable flags (SecurityWeek).

That modularity is a key part of why the framework matters. Microsoft said the core component’s commands show NeedyMantis can be expanded through additional modules, though the specific capabilities of those modules remain unconfirmed, as summarized by SecurityWeek ().