Kaspersky
CompanySecurity timeline
- Malware reported by The RecordNetamLoader malware targets custom Windows 10 build used by Asian government bodies
- Malware reported by GBHackersNetamLoader malware hidden in Windows update files targets Asian governments
Recent news
Kaspersky finds AI-orchestrated CyberStrikeAI framework used in real attacks on education sector
Kaspersky's threat intelligence team found a campaign using CyberStrikeAI, an open-source Go-based penetration testing platform that combines LLM-driven orchestration with a built-in C2 server. A human operator first gained access through a compromised Microsoft SQL Server 16.0.1000, after which the LLM chose and sequenced commands for persistence, reconnaissance, SMB and WMI lateral movement, credential dumping and database export, reaching full domain compromise.
NetamLoader malware targets custom Windows 10 build used by Asian government bodies
Kaspersky's GReAT team reported NetamLoader, a .NET and XAML-based loader found in a CAB archive in the Windows update download folder, built for a custom Windows 10 build used only by Asian government bodies. It abuses Microsoft-signed components, patches AMSI, cleans up logs and contacts its C2 server slowly to evade sandboxes and EDR. Kaspersky saw one victim, could not say how the archive was delivered and found no sign that Patch My PC was compromised.
Criminals exploit ebook downloads with malware, fake search pages and phishing
Kaspersky describes how attackers target ebook readers through pirate sites that deliver malware disguised as books, including a miner and infostealers hidden in fake PDFs. Search spam pages, fake Goodreads and Orell Füssli adverts, and clones of pirate libraries such as Z-Library are used to harvest card details and credentials. The article also notes a 2024 Z-Library clone leak of about 10 million user records and a 2025 Kindle vulnerability that could allow account hijacking.
NetamLoader malware hidden in Windows update files targets Asian governments
Kaspersky researchers have identified NetamLoader, a .NET loading framework built on XAML markup, which appears to be a supply-chain attack on a customised Windows build used only by Asian government bodies. Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load the malware. No known APT group has been linked to the campaign.