Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
4 IOCs

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence
Microsoft Threat Intelligence
Published September 28, 2026Original Report

Malware Families

Excerpt

In this article Observed operators and targeting Malware packaging and distribution NeedyMantis architecture and capabilities Mitigation and protection guidance Hunting queries Indicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREcorp.tripswithengine.…CAPABILITYCobalt StrikeImpacketVICTIMunknown
Adversary
Infrastructure(1)
Capability(2)
Victim

Indicators of Compromise

Open the mindmap →

4 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domaincorp.tripswithengine.comHighScore 68/100First seen
SHA256e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382eHighScore 86/100First seen
SHA256c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77HighScore 61/100First seen
SHA2569cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077efHighScore 61/100First seen

IOC Relationship Graph

Building graph…