Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

thehackernews.com Sep 28, 2026

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Curated by Shubham · TechCapsules · Sep 28, 2026

AI-summarised brief · reviewed before publication

Microsoft’s technical analysis revealed that the malware family NeedyMantis has been used by attackers to maintain long‑term access in a handful of targeted intrusions, including telecoms, universities, medical nonprofits, intergovernmental bodies, and government contractors. First identified in October 2025, NeedyMantis arrives as a bundle of a legitimate program, a malicious DLL, and an encrypted archive, employing DLL sideloading. The malware connects to a command‑and‑control server via HTTPS and WebSocket, allowing operators to load additional modules. Microsoft linked the activity to the Storm‑3069 group, likely originating in China, and noted its presence in the DAEMON Tools supply‑chain attack.

💡 Why It Matters

· The discovery shows how sophisticated adversaries can embed persistent footholds in high‑value sectors, complicating detection and removal.
· It underscores the need for vigilant monitoring of DLL sideloading and encrypted payloads in seemingly benign software.

Capsules Cybersecurity

Read full article on thehackernews.com

CyberIsle 2026 brings cyber security experts to Isle of Man

CyberIsle 2026, the Isle of Man Government’s flagship cyber‑security conference, will convene at the Comis Hotel & Golf Resort in Santon on Thursday, 15 October. The event marks the eighth edition and will host more than a dozen leading cyber‑security organisations, government officials, and island businesses. Speakers will address the theme “Cyber Security for an Uncertain Future,” focusing on anticipating change, strengthening digital infrastructure, and safeguarding critical systems amid rapid technological evolution and geopolitical tension. The conference aims to equip business leaders, IT professionals, and policymakers with actionable insights to counter emerging cyber threats.

💡 By spotlighting AI‑driven attacks and supply‑chain vulnerabilities, the event underscores the urgency for proactive, cross‑sector collaboration to protect the Isle of Man’s digital economy.

forbes.com · Sep 28

The Machine Can Be Persuaded: Why AI’s Context Is Becoming A Security…

The article argues that AI context is emerging as a critical security boundary, as modern generative models can be persuaded through language patterns similar to human social engineering. It notes that traditional cybersecurity has focused on protecting systems from external attacks and training users to resist phishing, but the rise of agentic AI blurs the line between human manipulation and system exploitation. Because AI models learn from human interactions and can act autonomously, attackers can influence them by crafting prompts that exploit authority cues, emotional triggers, or contextual ambiguities. The piece highlights that this vulnerability demands new defensive strategies that treat AI context—its prompts, training data, and runtime environment—as a security perimeter, rather than merely safeguarding code or network layers.

💡 AI‑driven attacks can bypass conventional defenses by hijacking the very language that powers intelligent agents, turning conversational interfaces into covert attack vectors.

energy-storage.news · Sep 28

Urgent need for cybersecurity overhaul as BESS deployment accelerates, Energy Storage Europe…

Energy Storage Europe released a report urging the EU to overhaul its cybersecurity framework for battery energy storage systems (BESS). The study highlights regulatory gaps and inconsistent member‑state implementation that raise costs and slow deployment while exposing grid‑level risks. With BESS capacity already at 50 GW and projected to reach 200 GW by 2030, the organization calls for reclassifying key components as critical, harmonising connectivity standards, and issuing joint guidance under NIS2 and the Cyber Resilience Act.

💡 The rapid BESS expansion turns isolated cyber threats into systemic risks that could destabilise the European grid. A unified regulatory approach is essential to protect critical infrastructure and ensure reliable energy delivery.

securitybrief.asia · Sep 28

In the AI era, channel value is being redefined

In September 2026, Simon Oliver, Channel Leader for APAC at Gigamon, highlighted a shift in partner value amid AI‑driven data growth. Gigamon’s research shows network data volumes have quadrupled, creating blind spots that traditional tools miss. A 2026 Hybrid Cloud Security Survey revealed 93 % of organizations invested in detection and visibility tools, yet only 30 % felt those tools could effectively counter breaches. Oliver argues partners must now focus on optimizing existing infrastructure, ensuring data quality and context, rather than merely selling new solutions. This strategic pivot aims to reduce IT sprawl and enhance security efficacy.

💡 By redefining partner roles to optimize current assets, organizations can close critical blind spots and improve breach response, directly addressing the escalating threat landscape driven by AI‑generated data.

analyticsinsight.net · Sep 28

Cybersecurity: The Complete Guide to Digital Security, Cyber Threats, Protection

AI agents now perform complex cyber tasks, exposing digital systems to new risks. Rising software vulnerabilities heighten the need for rigorous risk assessment, patch management, and robust security controls. David Sutton’s 2022 second edition of Cybersecurity: The Complete Guide to Cyber Threats and Protection remains foundational, covering threats, risk, recovery, and best practices across a 222‑page framework. However, it lacks coverage of AI‑driven attacks, a gap highlighted by Google’s Gemini model breaching three companies in 2026. The Forum of Incident Response and Security Teams projects 66,000 CVEs by 2026, underscoring the growing threat landscape.

💡 The surge in AI‑enabled attacks forces security teams to expand controls beyond traditional human and technical defenses, reshaping threat mitigation strategies.

thehackernews.com · Sep 28

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

The U.S. Cybersecurity and Infrastructure Security Agency added two critical Citrix NetScaler ADC and Gateway vulnerabilities, CVE‑2026‑88771 and CVE‑2026‑88772, to its Known Exploited Vulnerabilities catalog after confirming active exploitation worldwide. CVE‑2026‑88771 affects all NetScaler ADC and Gateway deployments, while CVE‑2026‑88772 requires the DTLS configuration, which is enabled by default on VPN virtual servers. Citrix has released patches for versions below the affected releases and provided indicators of compromise. Federal agencies must apply fixes by September 30, 2026.

💡 The vulnerabilities expose a broad range of enterprise networks to remote code execution, forcing organizations to prioritize patching amid complex deployment environments. The alert underscores the urgency of addressing zero‑day exploits that can be leveraged by attackers to gain persistent, high‑level access.