'NeedyMantis' Provides Long-Term Access to Compromised Networks

Microsoft says a previously unseen malware framework, NeedyMantis, is being used by a China-based threat actor to maintain long-term, stealthy access after initial compromise, with targeting that includes telecoms, universities, healthcare nonprofits, intergovernmental organizations, and government contractors. For CIOs and technology leaders, the key implication is that perimeter defenses and initial intrusion detection are no longer enough; IT teams need stronger post-breach visibility, endpoint and identity monitoring, and controls that can detect DLL sideloading, encrypted loaders, and suspicious remote command-and-control activity. The business risk is prolonged dwell time and potential espionage or deeper lateral movement into sensitive systems, which can increase operational disruption, data exposure, and recovery costs.