Microsoft Dissects Daemon Tools NeedyMantis Malware

Microsoft has confirmed that a group exploiting the Daemon Tools software distribution has been using a sophisticated malware family called NeedyMantis. The agency’s analysis shows the malware relies on a modular design and a custom executable format to stay hidden on infected machines for extended periods.

The threat primarily targets Windows users who download Daemon Tools from unofficial sources or third‑party download sites. Once installed, the malicious payload drops additional components that can download further payloads, steal credentials, and manipulate system settings. The modular nature allows the attackers to update or replace parts of the code without redeploying the entire package, making detection harder for traditional antivirus tools.

NeedyMantis achieves persistence by creating a custom file type that is not recognized by standard security scanners. It then registers this file as a legitimate system component, allowing it to survive reboots and software updates. The framework also includes routines to evade sandbox analysis, meaning it can remain dormant until it detects a real user environment.

To reduce the risk of infection, users should obtain Daemon Tools only from the official website or reputable app stores. Running Windows Update regularly ensures that security patches are applied promptly. Employing a reputable, free anti‑malware scanner such as those listed on ComputerScams.com can help detect unusual files. Users should also enable built‑in Windows Defender real‑time protection and consider adding a second opinion scanner for layered defense.

If you suspect a compromised system, disconnect it from the network, run a full system scan, and change passwords for any accounts accessed from the machine. Keep backups of important files on an offline medium to avoid data loss in case of future attacks.

A practical step you can take right now is to verify the digital signature of any Daemon Tools installer before running it; right‑click the file, select Properties, and check the Digital Signatures tab for a valid signature from the legitimate publisher.

Source: Read the original report