Breaches and incidentsBriefChecked against a primary source
NetamLoader: suspected supply-chain implant in a government-only Windows 10 build in Asia
Kaspersky found one victim in Asia running a “specially customized government-only version” of Windows; it infers Asian government targets.
- Disclosed
What happened
- Kaspersky found one victim in Asia running a “specially customized government-only version” of Windows; it infers Asian government targets. Whether data was stolen is unknown.
- Technique: a CAB in C:\Windows\SoftwareDistribution\Download held mostly legitimate Patch My PC components plus a malicious .config (AppDomainManager injection) and Resources.resx with layered payloads (AMSI bypass, .NET loader, XAML plugin in dllhost.exe, 20 to 40 minute C2 jitter, log and Prefetch cleanup). The delivery path was not observed.
- Attribution: Kaspersky says “no attribution to any known APT group has been established”. It says evidence “strongly indicates a supply-chain attack”.
- Response: research publication; no vendor statement.
Sources
- https://securelist.com/netamloader/121676/
- https://thehackernews.com/2026/11/netamloader-malware-targets-government.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.