NeedyMantis Deploys Custom Minimized PE DLLs via DLL Sideloading After Daemon Tools Supply Chain Hit

The infection begins with a first-stage loader abusing DLL sideloading on legitimate software bundles, extracting a second-stage loader that decompresses a minimized PE-formatted DLL. This main component handles C2 via WebSockets, exfiltrates system data, and supports load/unload/dispatch commands for additional modules. Observed Impacket toolkit activity confirms hands-on lateral movement after initial foothold, not initial compromise. Evidence from October 2025 onward activity shows consistent use against telecoms, universities, government contractors, and medical nonprofits in Belarus, Russia, and Thailand. The modular design with custom executable formats and encrypted archives prioritizes evasion over broad distribution. Microsoft attributes the framework to Storm-3069 without nation-state linkage despite China-based operators, yet the targeted post-exploitation pattern matches prior supply-chain follow-ons seen in other contractor ecosystems. Independent verification of C2 infrastructure and module telemetry remains limited to the dozen confirmed backdoors. Operational risk centers on undetected module expansion in scientific and manufacturing sectors. Expect follow-on campaigns leveraging similar sideloading vectors in new vendor updates within six months, tracked via archive hash and loader signatures.