[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOd7KOQ8O3rfofK9_xm_vw76pKAVpLyo4PCuZeRwnkYk":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"d9a828ab-d945-49ef-94ad-c10b57046cda","APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments","apt-hackers-use-netamloader-malware-to-target-windows-10-systems-in-asian-govern-3b64ce","A new malware framework called NetamLoader is being used against a custom version of Windows 10 that only government bodies in Asia use. The campaign looks like a supply-chain operation, and nobody has linked it to a known hacking group yet. The malware hides inside a Windows update package, borrows trusted software to run, and […] The post APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments appeared first on Cyber Security News.","A new malware framework, NetamLoader, is targeting a custom version of Windows 10 used by Asian government bodies. The attack appears to be a supply-chain operation, with the malware concealed within a Windows update package and leveraging trusted software to execute while deleting its traces. It employs slow communication with its C2 server to evade detection.","APT hackers use NetamLoader malware hidden in Windows updates to target Asian government systems.","https:\u002F\u002Fcybersecuritynews.com\u002Fnetamloader-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FAPT-Hackers-Use-NetamLoader-Malware-to-Target-Windows-10-Systems-in-Asian-Governments.webp","2026-10-30T15:02:03+00:00","2026-10-30T16:00:07.076244+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Windows 10","product",{"name":21,"type":19},"Patch My PC",{"name":23,"type":24},"AMSI","technology",{"name":26,"type":24},"AppDomainManager injection",{"name":28,"type":24},"BinaryFormatter",{"name":30,"type":31},"Kaspersky","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60],{"type":57,"value":58,"context":59},"domain","openaigpt4v[.]com","Command and Control (C2) server domain used by NetamLoader.",{"type":52,"value":61,"context":62},"NetamLoader","Name of the malware framework used in the attack.",[30,18,21],{"controls":65,"vendors":150},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"patch-management","Automated patch management","Known holes get closed in days, not months.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":67,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":145,"product_name":146,"url":148,"description":149},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"netamloader-targets-asian-governments-via-trojanized-windows-update-packages","NetamLoader Targets Asian Governments via Trojanized Windows Update Packages","APT actors embedded the NetamLoader malware inside a weaponized Windows update package, exploiting the implicit trust organizations place in software update mechanisms — a hallmark supply-chain attack. By masquerading as a legitimate update and leveraging trusted system processes to execute, the malware bypassed conventional security controls while actively deleting forensic traces to hinder detection. The use of slow, low-volume C2 communication was a deliberate evasion technique designed to slip beneath behavioral detection thresholds. This incident highlights the critical danger of blindly trusting update packages without cryptographic verification and the inadequacy of detection tools not tuned for low-and-slow attack patterns. When adversaries abuse the software supply chain, the consequences extend beyond individual systems to entire government networks that share the same compromised baseline.",[162,163,164,165,166,167,168],"MITRE ATT&CK T1566: Phishing","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":170,"MITRE ATT&CK T1566: Phishing":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"CIS Control 17: Incident Response Management":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 requires government and essential-service entities to implement supply-chain security measures; the absence of such measures allowed a malicious actor to weaponize the software supply chain against Asian government bodies without detection.","While delivery here was via a trojanized update package rather than email, ATT&CK's supply-chain and trusted-relationship sub-techniques (T1195) directly model how NetamLoader abused trust in the update process; mapping to this framework would have driven detection controls for malicious delivery disguised as legitimate software.","SI-2 requires organizations to verify the integrity of software received from vendors, which — if applied to the update pipeline — would have detected the malicious modification concealed within the Windows update package.","Because the malware actively deleted its own traces, a mature incident response capability with pre-existing forensic logging and tamper-evident audit trails — as required by this control — would have been necessary to reconstruct the attack timeline and contain the breach effectively.","A rigorous update management process that includes integrity verification of patches before deployment would have flagged the tampered Windows update package before it was distributed across government systems.","This control mandates timely identification and response to technical vulnerabilities including vetting of supplier-provided updates, directly addressing the failure to authenticate the integrity of the trojanized package.","Enforcing strict controls over which processes and packages are permitted to execute — including cryptographic authentication of update sources — would have prevented the malware from using trusted software as a launchpad."]