APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments

APT actors embedded the NetamLoader malware inside a weaponized Windows update package, exploiting the implicit trust organizations place in software update mechanisms — a hallmark supply-chain attack. By masquerading as a legitimate update and leveraging trusted system processes to execute, the malware bypassed conventional security controls while actively deleting forensic traces to hinder detection. The use of slow, low-volume C2 communication was a deliberate evasion technique designed to slip beneath behavioral detection thresholds. This incident highlights the critical danger of blindly trusting update packages without cryptographic verification and the inadequacy of detection tools not tuned for low-and-slow attack patterns. When adversaries abuse the software supply chain, the consequences extend beyond individual systems to entire government networks that share the same compromised baseline.