Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

A sophisticated supply-chain attack named NetamLoader targets a custom Windows 10 build used exclusively by government entities in Asia. The attack uses a multi-stage infection chain involving CAB archives in Windows update directories, exploiting AppDomainManager injection and BinaryFormatter deserialization vulnerabilities. It bypasses AMSI protections, uses AES encryption for network communications, and employs anti-analysis techniques including long polling intervals and forensic evidence removal. The malware operates covertly by migrating to dllhost.exe and executing payloads in isolated AppDomains. Commercial hosting infrastructure such as Cloudflare CDN is used for command-and-control communications.

• NIK C2: The new AI-enabled command-and-control frameworkMalware2026-10-29
• Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File InflationMalware2026-07-07
• From Phishing to Persistence: A CrySome RAT Infection Chain AnalysisMalware2026-07-07
• Inside DesckVB Rat Analysis: From Malspam to In-Memory RATMalware2026-06-03
• TanStack npm Packages Compromised in Ongoing Supply-Chain AttackMalware2026-05-12