{
  "id": 17556852,
  "title": "NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection",
  "url": "https://urgent.news/2026/11/01/netamloader-malware-targets-government-windows-10-systems-in-asia-via",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T07:02:58.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/netamloader-malware-targets-government.html"
  },
  "original_language": "en",
  "account": "Cybersecurity experts have revealed a complex malware campaign targeting government Windows 10 systems in Asia. Kaspersky Labs disclosed the details of the attack this week, which utilized a custom Windows 10 build used exclusively by government entities in the region. The malware, dubbed NetamLoader, employs a .NET assembly-loading framework to inject malicious code into legitimate applications, making it difficult to detect. The attack, believed to be supply chain-based, involved compromising a trusted third-party vendor to gain access to downstream users. Kaspersky identified a single victim in Asia, though it remains unclear if additional systems were compromised or sensitive information stolen. The malware was detected in the first half of 2026, packaged within a Windows cabinet archive placed in a directory storing Windows operating system update packages. The attack involved a two-stage process, with the first stage persisting for 5-6 minutes after receiving a valid response from a command and control server, and the second stage pausing for 22-28 hours. NetamLoader is designed to attack a specialized Windows 10 build used only by government organizations in Asia, and it exploits the AppDomainManager injection technique to load arbitrary .NET assemblies. This technique hijacks .NET Framework's AppDomainManager mechanism when a .NET application starts, allowing the malware to execute malicious code within a legitimate application's process.",
  "summary": "Cybersecurity researchers have disclosed details of what has been described as a \"highly sophisticated infection chain\" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}