- Microsoft detailed NeedyMantis, a malware family used for long-term access with DLL sideloading and WebSocket command-and-control.
- Dutch police arrested a 24-year-old man linked to ShinyHunters; reports identify him as Pepijn van der Stap, while the group claimed an FBI jobs portal breach.
- ShinyHunters exploited Oracle PeopleSoft CVE-2026-35273 and reportedly bypassed WAF rules, affecting education, tech, healthcare, agriculture, transport and government.
- Proofpoint says TA419, a China-aligned group, impersonated AI policy experts to steal credentials from think tanks and contractors.
Recent developments in the hacking world have moved on two tracks at once: state-linked espionage crews looking for long-term access, and criminal extortion groups behaving more aggressively than usual. Microsoft has published a technical breakdown of a malware family called NeedyMantis, which has been used in a limited set of intrusions against telecoms, universities, medical nonprofits, intergovernmental bodies and government contractors. The tool appears designed to keep intruders inside networks after the first break-in, rather than to spread itself widely.
At the same time, Dutch authorities have detained a 24-year-old man in connection with ShinyHunters, a gang linked to major data thefts and ransom threats. The arrest has not slowed the group’s public bravado: within days, it claimed responsibility for an intrusion at an FBI jobs portal and was tied to the exploitation of a PeopleSoft vulnerability. Separately, researchers say a China-aligned crew called TA419 has been impersonating AI policy experts to steal credentials from think tanks, contractors and universities.
Microsoft links NeedyMantis to long-term intrusions
Microsoft’s analysis says NeedyMantis has been observed since at least October 2025 and appeared in a small number of targeted operations. Victims include telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware is meant for persistence and control, not mass disruption.
The trail leading to NeedyMantis came partly from Kaspersky’s probe into a supply chain attack on DAEMON Tools. Official signed installers for DAEMON Tools Lite carried malicious code from April 8, 2026, and the developer restored a clean version on May 5. Microsoft tracks related activity as Storm-3069, but it has not seen NeedyMantis itself arrive through that supply chain.
The malware bundle usually has three pieces: a legitimate program, a malicious DLL named after a file the program loads, and an encrypted archive with the same label. When the app launches, it loads the rogue DLL, a technique known as DLL sideloading.
Legitimate programs abused in this way include Poedit, curl, Vim, and TightVNC. The malware has also disguised itself as DLLs tied to Microsoft Office, Broadcom, Intel, and NVIDIA. In one sample, it replaced WinSparkle.dll, Poedit’s update component.
How the payload hides its traffic
In the detailed sample, an operator already inside the network used Impacket to copy the bundle from a shared folder and execute it on a target machine. Initial access may vary from one case to the next.
Once loaded, the DLL extracts the next stage from the encrypted archive and runs it. That stage decodes the main component, which contacts a command-and-control server over HTTPS and then switches to a WebSocket connection.
Through that channel, operators can load and unload extra modules and send data to them. Microsoft has not confirmed what those modules do. An older version from October 2025 included a persistence module that used Windows services; the newer version’s persistence method was not detailed.
Attribution to China remains cautious
Storm-3069 is a temporary label Microsoft gives to new or developing clusters until it is more confident about who is behind them. The company has seen NeedyMantis outside the DAEMON Tools campaign and says more than one group may be using it. It has not determined whether all activity comes from one actor.
Microsoft assesses the activity appears to originate in China but has not tied Storm-3069 to a Chinese nation-state actor. The targets and selective victim set fit patterns the company associates with China. Kaspersky found Chinese-language text in the DAEMON Tools malware but did not attribute it.
Google Threat Intelligence Group tracks the actor behind the DAEMON Tools campaign as UNC6863. Mandiant has described UNC6863 as a suspected China-nexus actor that used the DAEMON Tools compromise to deploy malware. Whether UNC6863 and Storm-3069 are the same remains unclear.
Indicators, detection and cleanup
Microsoft’s published indicators include three SHA-256 hashes tied to the first-stage loader and encrypted archives, plus the C2 domain corp.tripswithenginecom on port 443 and a hard-coded user agent of firefox/21.0.
- e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e – first-stage loader WinSparkle.dll, first seen May 21, 2026.
- 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef – encrypted archive named WinSparkle, first seen May 23, 2026.
- c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 – encrypted archive named libcurl, older version, first seen October 3, 2025.
File paths seen with the malicious DLLs involve Poedit, libcurl, Vim, TightVNC, Office, Broadcom, Intel and NVIDIA-related components under common program and program data folders.
Defender detects the malware as TrojanDropper:Win64/NeedyMantis and Behavior:Win64/NeedyMantis. The hunting queries look back only seven days, so they would not find older events from October 2025 or May 2026 unless adjusted. A hit on the Poedit path alone is not proof because WinSparkle.dll is also a normal Poedit component.
Microsoft recommends cloud-delivered protection, block at first sight, EDR in block mode, network protection, automatic attack disruption, and certain attack surface reduction rules. It also suggests checking outbound traffic for connections to the C2 domain, which can be done without Defender. Anyone who installed the affected DAEMON Tools Lite 12.5.1 should uninstall it, run a full scan, and get version 12.6 from the official site.
Dutch arrest puts ShinyHunters under pressure
Dutch authorities have confirmed the arrest of a 24-year-old man as part of an investigation into ShinyHunters, a group accused of data theft and extortion at more than 140 organizations worldwide. Police said the man was arrested on September 15 and ordered held in custody for at least 90 days.
Multiple reports identify the suspect as Pepijn van der Stap, a convicted cybercriminal who once used the handle Umbreon. He was sentenced in 2023 to four years, one suspended, for data thefts and extortions that prosecutors said generated between €1.5 million and €2.7 million. He was released from prison in December 2025.
Before his arrest, van der Stap presented himself as reformed and worked in a senior security role at Neo Security, according to interviews and media reports. He had also volunteered at the Dutch Institute for Vulnerability Disclosure, which later disclosed an internal cybersecurity incident involving malicious AI use and said it did not appear tied to ShinyHunters. Neo Security did not respond to requests for comment.
Dutch police have sought public help identifying the voice in a February 2026 call that social-engineered an Odido employee into logging into a spoofed site, leading to data theft on more than 6.2 million Dutch people. ShinyHunters confirmed the caller was a member, though the arrested man has not been formally tied to the Odido case.
Investigators also suspect van der Stap tried to arrange at least two murders abroad, according to RTL, based on information found after his arrest. Dutch authorities described that line of inquiry as separate from the ShinyHunters investigation.
FBI jobs portal breach and PeopleSoft exploitation
Days after the arrest, ShinyHunters claimed credit for a breach at the FBI’s job application site, apply.fbijobs.gov. Reports said stolen data included Social Security numbers and personal details on more than 5,000 officials, along with job titles or teams such as special agent, threat intake examiner, major cybercrimes unit, and staff investigating foreign state-backed cyber threats.
Reuters examined documents shared by the group and found sensitive psychiatric and medical files involving FBI staff. The breach has raised counterintelligence concerns because of the nature of the data. The bureau has not offered a detailed public account of the incident.
ShinyHunters said it gained access by exploiting a recently patched flaw, CVE-2026-35273, in Oracle PeopleSoft, a widely used HR and hiring platform. Oracle issued a fix after the flaw was reportedly used as a zero-day beginning in June.
Mandiant released web application firewall rules for organizations that could not patch quickly, but BleepingComputer reported that ShinyHunters used a URL-encoding trick to bypass them. A September 25 report from Mandiant and Google Threat Intelligence Group confirmed mass exploitation of the PeopleSoft vulnerability across higher education, technology, healthcare, agriculture, transportation and government.
ShinyHunters told TechCrunch the FBI breach was not financially motivated and was meant to challenge allegations against the group. It said it would not publish the stolen FBI data. The FBI’s cyber division chief, Brett Leatherman, thanked Dutch partners and urged remaining members to turn themselves in.
A leadership fight inside ShinyHunters
Sources close to the investigation say the group’s recent risky moves against the FBI and the Russian ransomware crew Cl0p signal a shift from its older, more measured style. The change reportedly followed a takeover by a teenage cybercriminal from Amman, Jordan, known as Rey, who operates within a coalition called ScatteredLapsussHunters.
That coalition is described as a blend of Scattered Spider, LAPSUS$ and ShinyHunters. Rey allegedly had a dispute with the Dutch hacker over control of the ShinyHunters brand and data. The oversized Umbreon image left on the FBI defacement page was seen as an attempt to pin the hack on the Dutchman.
Rey taunted Cl0p and the FBI on Twitter/X with a meme; his account was later deleted after a reporter sought an interview. The Wired report says ShinyHunters and SLSH briefly partnered with TeamPCP to monetize stolen credentials, then ShinyHunters went rogue and kept proceeds. Mandiant had infiltrated TeamPCP and fed credentials to cloud providers, which invalidated the keys.
Mandiant researcher Austin Larsen said ShinyHunters has been on an extortion spree and could pull in nearly $100 million from victims in 2026. Van der Stap has claimed his earlier crimes were driven by a desire to collect databases, not money.
China-aligned TA419 impersonates AI policy experts
Proofpoint says a China-aligned group called TA419 has been impersonating AI experts in the US, including Lynne Edwards Parker, a former principal deputy director of the White House Office of Science and Technology Policy. The campaign has been active since April 2025.
The emails looked harmless at first and often invited recipients to join an ‘AI Policy Advisory Committee.’ Once a target replied, the attackers sent a fake login page designed to steal credentials. Victims included policy experts at think tanks, defense contractors, universities and law firms in the US and Japan.
The technique creates a fake browser pop-up inside a legitimate webpage, mimicking a real sign-in prompt so victims are less likely to realize they are handing over information. Proofpoint did not name all targets, but Reuters confirmed Alex Engler, a former White House official now leading the Penn Center on Media, Technology, and Democracy, received one of the messages and found it was from an impersonator.
In February, the same group impersonated a prominent Anthropic employee while targeting AI policy experts. Proofpoint expects TA419 to continue using real-world expert identities against think tanks and policy specialists. Parker did not respond to Al Jazeera’s request for comment.
What people and defenders should watch
For security teams, the NeedyMantis indicators and PeopleSoft exploitation show how attackers mix trusted software, stolen credentials and known vulnerabilities. Checking outbound traffic, reviewing unusual DLL loads, and patching exposed HR or hiring platforms can reduce the window.
For ordinary users, the TA419 campaign is a reminder that polished emails and realistic login prompts can still be phishing. Verifying unexpected invitations through a second channel and using phishing-resistant multifactor authentication helps.
Across these cases, the common thread is access: state-linked crews want to stay hidden inside networks, while criminal gangs want to turn stolen data into payments and public leverage. The NeedyMantis analysis shows how DLL sideloading and WebSocket C2 can turn legitimate tools into a foothold; the ShinyHunters arrest and FBI breach show how quickly a hacking brand can escalate after internal turmoil; and TA419’s AI-themed phishing shows that social engineering still works best when it borrows a trusted name. None of these stories is isolated, and the defensive lessons overlap: patch fast, watch for unusual traffic and file loads, and treat unsolicited login requests with suspicion.
