Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

A previously unknown advanced persistent threat (APT) group is conducting targeted attacks against government entities in Asia using a sophisticated .NET-based malware framework dubbed NetamLoader. The attack begins with a malicious CAB file placed in the Windows update directory, which leverages AppDomainManager injection and a chain of XAML-based payloads to load malicious .NET assemblies. The infection chain includes AMSI bypass techniques, process hollowing via COM objects, and encrypted C2 communication using AES-CBC with HMAC. The malware targets a custom Windows 10 build used by Asian governments and communicates with a C2 server hosted behind Cloudflare infrastructure.

AI-extracted · verify before operational use