NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

In this article 1. Observed operators and targeting 2. Malware packaging and distribution 3. NeedyMantis architecture and capabilities 4. Mitigation and protection guidance 5. Hunting queries 6. Indicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular...

Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers

The threat actor behind the SolarWinds supply chain attack has been linked to yet another "highly targeted" post-exploitation malware that could be used to maintain persistent access to compromised environments. Dubbed MagicWeb by Microsoft's threat intelligence teams, the development reiterates...