InfoSecBulletin Cybersecurity for mankind
A new malware framework named NetamLoader is attacking a special version of Windows 10 used only by government agencies in Asia. The campaign seems like a supply-chain attack, and no one has connected it to a known hacking group so far.
The malware hides inside a Windows update package, borrows trusted software to run, and deletes its own traces. It also talks to its operators very slowly, so quick security checks might miss it. Even a file that seems safe and signed by a known seller can cause an infection.
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
Analysts at Securelist, the research blog of Kaspersky’s GReAT team, found the malware and shared the complete report on October 29, 2026.
Kaspersky discovered it in early 2026 when its threat network noticed a strange .config file. The file was in a CAB archive in the folder where Windows stores update packages.
Kaspersky found one victim using its KSN telemetry data. The malware was made for a Windows version used only by the government. The researchers think the targets are Asian government groups.
The report says that countries making their own operating systems need to protect all the software by themselves, and this takes time.
Kaspersky detects the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast., and Trojan.Script.Agent.. Defenders should watch update folders for unexpected config files and signed programs that load code in odd ways.
They should also look for unusual Windows processes with outside connections and for missing log entries. Sending logs to a central server helps keep evidence if the malware wipes local copies.
Related news:
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
Gov.t issues high alert on android devices
