September 29, 2026
- NeedyMantis, a modular implant used for long-term access since at least October 2025, hit telecoms, universities, medical nonprofits, intergovernmental organisations and government contractors. Delivery is DLL sideloading via legitimate binaries (Poedit, curl, Vim, TightVNC), with an encrypted archive staging the next stage; C2 starts over HTTPS then upgrades to WebSocket for module loading. Microsoft found it while following Kaspersky's DAEMON Tools supply-chain investigation and ties one user to Storm-3069; hashes, domains, paths and hunting queries are published (The Hacker News). · Threat Activity
in PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch