NEEDYMANTIS: UNPACKING A POST-COMPROMISE MALWARE FAMILY USED IN TARGETED OPERATIONS

**H1** Uncovering the NeedyMantis: A Post-Compromise Malware Family Used in Targeted Operations

**Introduction**

In the world of cybersecurity, threats are constantly evolving, and one such example is the NeedyMantis malware family. First spotted in 2020, this post-compromise malware has been linked to targeted operations, demonstrating a level of sophistication and adaptability. A recent investigation into Storm-2570's tradecraft has shed light on the tactics, techniques, and procedures (TTPs) employed by this malware family, revealing a consistent approach to infection and data exfiltration.

**The Rise of NeedyMantis**

NeedyMantis is a type of malware that operates in the post-compromise phase, meaning it infects a system after initial exploitation has occurred. This family has been observed targeting various industries, including government, finance, and technology sectors. One notable aspect of NeedyMantis is its ability to adapt to different environments, making it a challenging adversary for security teams. The malware's primary goal is to establish persistence and steal sensitive data, often using custom-made tools for this purpose.

The investigation into Storm-2570's tradecraft has revealed a consistent approach to infection and data exfiltration. The attackers typically begin by exploiting vulnerabilities in software or using social engineering tactics to gain initial access. Once inside the network, they employ tools such as Windows Management Instrumentation (WMI) to move laterally and establish persistence. The use of WMI is particularly noteworthy, as it allows the attackers to maintain a low profile and avoid detection.

**Tools and Techniques**

The NeedyMantis malware family has been observed utilizing a range of custom-made tools to facilitate data exfiltration. One such tool, known as "Ghoul," has been linked to the Storm-2570 group. Ghoul is a data exfiltration tool that uses HTTPS to transmit stolen data to a command and control (C2) server. The use of HTTPS is a deliberate attempt to evade detection by security software, as many tools are unable to inspect encrypted traffic. Ghoul's ability to communicate with C2 servers using HTTPS also suggests that the attackers are aware of the importance of maintaining a secure communication channel.

Another tool observed in the NeedyMantis arsenal is "Dolofor," a lateral movement tool used to move within the network and establish persistence. Dolofor employs WMI to create a hidden directory on the compromised system, which is then used to store malware artifacts. The use of WMI in this context is consistent with the attackers' aim of maintaining a low profile and avoiding detection.

**Data Breach and Malware Connection**

The connection between NeedyMantis and Storm-2570's tradecraft highlights the importance of a holistic approach to cybersecurity. By examining the tactics, techniques, and procedures employed by this malware family, security teams can gain valuable insights into the adversary's mindset and behavior. In the case of NeedyMantis, the attackers' use of custom-made tools and techniques to establish persistence and steal sensitive data demonstrates a clear intent to compromise the security of targeted organizations.

The data breach aspect of NeedyMantis cannot be overstated. The malware's primary goal is to steal sensitive data, often using custom-made tools for this purpose. This raises concerns about the potential for sensitive data to be compromised, and the importance of implementing robust security measures to prevent such breaches.

**Conclusion**

The NeedyMantis malware family has been a persistent threat in the cybersecurity landscape, with a range of custom-made tools and techniques employed to facilitate data exfiltration. By examining the tradecraft of Storm-2570, we can gain valuable insights into the tactics, techniques, and procedures employed by this malware family. As security teams, it is essential to stay vigilant and aware of the evolving threat landscape, using this knowledge to inform our defenses and prevent such breaches in the future.

**Recommendations**

1. **Implement robust security measures**: Ensure that your organization's security posture is robust and up-to-date, including regular software updates, patch management, and employee training. 2. **Monitor for suspicious activity**: Implement continuous monitoring and incident response capabilities to detect and respond to potential security incidents. 3. **Stay informed**: Stay informed about emerging threats and stay up-to-date with the latest cybersecurity news and research.

By taking these steps, you can help protect your organization from the evolving threat of NeedyMantis and other post-compromise malware families.