Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

Introduction A couple of months ago, our research revealed a highly sophisticated infection chain and a complex .NET assembly-loading framework built on XAML markup, which strongly indicates a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia.

Summary from Kaspersky Securelist.

Explained

The technology and terms in this story. Learn more

More in Endpoint

SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign

Podcast8 minSANS Internet Storm Center StormCast2h agoVulnerabilitiesAIEndpointCVE-2026-98432

Fake crypto app on Apple App Store linked to $23K wallet theft

BleepingComputer10h agoEndpoint

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

The Register Security10h agoVulnerabilitiesEndpointNetwork

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike11h agoVulnerabilitiesEndpointCVE-2026-109618CVE-2026-109619

Claude Model Builds Exploits Across Major Browsers & OSes

Dark Reading11h agoVulnerabilitiesAIEndpoint