Introduction A couple of months ago, our research revealed a highly sophisticated infection chain and a complex .NET assembly-loading framework built on XAML markup, which strongly indicates a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia. The malicious framework has been labeled NetamLoader; at present, no attribution to any known APT group has been established.
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
About this summary. This is a short excerpt from the description that Kaspersky Securelist published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securelist.com/netamloader/121676/
Source attribution: headline and facts are from Kaspersky Securelist (securelist.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
What happens when security tools go dark before the ransomware
On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four…
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Attack overview Technical details Mitigation and protection guidance Indicators of compromise References Learn More On October 21, 2026, a compromised LiteLLM 1.107.0…
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Two senators say that revelations about online targeted advertising being used as a vector for spyware infections underscore the need for better security practices in…
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX
China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a…
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using…
SEO Poisoning Campaign Delivers New Armorsteal Malware
IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the…