NetamLoader malware hidden in Windows update files targets Asian governments
MALWAREKasperskyredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Kaspersky reports NetamLoader, a .NET loading framework built on XAML markup, delivered as a supply-chain compromise of a customised Windows build used only by Asian government bodies. Kaspersky Security Network detected a .config file abusing AppDomainManager injection to load the payload. No known APT group has been attributed. The article gives no CVE IDs, affected Windows versions or IOCs, so defenders should review .config files and AppDomainManager settings in .NET applications and check whether their systems use any customised Windows builds.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review .config files in .NET applications for unexpected AppDomainManager entries.
- Check whether your systems use customised Windows builds and verify their update sources.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Companies
Products