Microsoft has published a technical analysis of NeedyMantis, the backdoor used by the attackers who compromised the Daemon Tools disk-imaging software in May, SecurityWeek reported Tuesday. The company attributes the activity to a China-based group it tracks as Storm-3069, but stops short of calling it a state operation.

What Happened

In May 2026, trojanized versions of Daemon Tools were distributed through the product's official website. SecurityWeek reported that thousands of computers were infected with the poisoned builds, but the attackers went on to deploy a backdoor on only about a dozen of them.

Microsoft's new report covers that second stage. It says Storm-3069 has not been attributed to a Chinese nation-state actor, and that NeedyMantis may be used by more than one China-based threat actor. The malware has been in use since at least October 2025, months before the Daemon Tools incident, and serves to keep long-term access and support follow-on operations after an initial break-in.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

Victims included government, scientific, manufacturing and retail organizations in Belarus, Russia and Thailand, according to SecurityWeek, as well as universities, government contractors, telecommunications companies, medical non-profits and intergovernmental organizations.

How NeedyMantis Works

Microsoft describes NeedyMantis as a modular post-compromise framework rather than a single implant. It relies on several loaders, custom encrypted file archives and custom executable formats, a design that makes analysis harder and lets operators add capabilities over time.

Deployment is hands-on. Once the operators already have access to an environment, they copy a legitimate program, a malicious DLL and an encrypted archive from a network share onto a chosen device and run them, using DLL sideloading so that the trusted program loads the attacker's code. Command and control runs over WebSockets through 10 dedicated functions. The operators can load and unload modules, collect system information and dispatch commands while the implant keeps its foothold.

Why It Matters

The Daemon Tools case shows the typical economics of a software supply chain attack. Poisoning a popular download gives attackers a large pool of compromised machines at once; they can then survey that pool and reserve their more valuable tooling for a small number of high-value targets. The ratio here, thousands of infections against roughly a dozen backdoors, suggests careful selection rather than broad monetization.

That selectivity also makes detection harder. A machine that installed the trojanized build may show only first-stage activity, while the organizations of real interest received a quieter, custom-packaged implant designed to blend in through a legitimate executable.

The victim list stands out. Most public reporting on China-based intrusion sets centers on targets in the United States, Europe and Asia-Pacific allies. Here the named countries include Russia and Belarus, which are political partners of Beijing, alongside Thailand. Microsoft's caution about attribution, and its note that the malware may be shared among several actors, means the targeting cannot yet be read as a single government's intelligence priorities.

What to Watch

Organizations that installed Daemon Tools from the official site during or after May should treat those systems as potentially exposed and review Microsoft's report for detection guidance, focusing on sideloaded DLLs and unexpected WebSockets traffic. Further research may clarify whether other China-based groups are running NeedyMantis and whether the Daemon Tools compromise was one of several delivery routes.