NetamLoader malware targets custom Windows 10 build used by Asian government bodies
MALWARECloudflareredteam/daily · 3 sources
- Severity
- High
- Sources
- 3
What happened
Kaspersky's GReAT team reported NetamLoader, a .NET and XAML-based loader found in a CAB archive in the Windows update download folder, built for a custom Windows 10 build used only by Asian government bodies. It abuses Microsoft-signed components, patches AMSI, cleans up logs and contacts its C2 server slowly to evade sandboxes and EDR. Kaspersky saw one victim, could not say how the archive was delivered and found no sign that Patch My PC was compromised.
For IT people · Written by AI from 3 sources · Wrong?
What to do
- Keep devices updated and install software only from official stores or the maker’s site.
General advice for this kind of story
Full story timeline · 3 updates
- Fri 30 OctoberHackers target government Windows systems in Asia with new malwareThe Record
- APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian GovernmentsCyber Security News
- Sun 1 NovemberNetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET InjectionThe Hacker News
Who reported · 3 outlets
The RecordCyber Security NewsThe Hacker News