Cybercriminals Deploy 'NeedyMantis' Malware to Sustain Access in Telecom Breaches, Microsoft Finds

Microsoft’s recent technical analysis reveals that a niche malware family known as NeedyMantis is being leveraged by threat actors to retain footholds in networks they have already compromised. The findings, first reported by The Hacker News, highlight a pattern of long‑term persistence rather than one‑off data theft.

NeedyMantis, which has surfaced in a limited set of targeted intrusions, appears to be purpose‑built for stealthy, ongoing control of victim environments. Security researchers observed the tool being introduced after an initial breach, allowing attackers to move laterally, exfiltrate data, and re‑enter the network without triggering standard detection mechanisms.

The incidents documented so far involve telecommunications providers, a sector that routinely handles high‑volume traffic and sensitive customer information. By embedding NeedyMantis within these networks, adversaries can exploit the inherent trust and critical infrastructure of telecom operators, potentially amplifying the reach of subsequent malicious campaigns.

Microsoft’s report notes that the malware’s architecture includes modules for command‑and‑control communication, credential harvesting, and the deployment of additional payloads. Its design emphasizes durability: the code can survive system reboots, updates, and even certain remediation attempts, making eradication a complex, time‑consuming process for incident responders.

Industry analysts say the emergence of NeedyMantis underscores a broader shift toward “living off the land” tactics, where attackers prioritize persistence over rapid exfiltration. This approach aligns with the growing sophistication of cyber‑espionage and financially motivated groups that seek to monetize compromised networks over extended periods.

Experts caution that the limited visibility of NeedyMantis so far does not preclude wider adoption. As threat actors refine their toolkits, organizations—especially those in the telecom sector—are urged to enhance threat‑hunting capabilities, implement stricter network segmentation, and regularly audit privileged access. Microsoft recommends leveraging its Defender suite and applying behavior‑based detection rules to spot the subtle indicators associated with the malware.

While no public attribution has been made, the pattern of targeted attacks on telecoms mirrors tactics employed by several known advanced persistent threat (APT) groups. Ongoing collaboration between private security firms, industry stakeholders, and government agencies will be essential to track the evolution of NeedyMantis and mitigate its potential impact on critical communications infrastructure.