Kaspersky finds NetamLoader in Windows update files on Asian government systems
One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.
72
Organization
Kaspersky
- Mentions · 7d11
- Mentions · 30d26
- All mentions57
- First seenAug 14, 2026
- Last mentioned17h ago
Timeline
57 articles · newest firstNetamLoader hides in Windows 10 update packages aimed at Asian governments
Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.
72
Kaspersky finds NetamLoader on one Asian government Windows system
The loader uses signed Microsoft components, can hide activity, and its delivery path is unconfirmed.
72
Post details algorithmic generation of false-positive alert filters
FP-Growth ranks field combinations from a detection rule's context and offers analysts the top three candidate filters.
32
Unknown APT deploys NetamLoader on government Windows 10 builds in Asia
Kaspersky traced a CAB in the Windows update folder to AppDomainManager injection and a layered .NET loader.
72
Intelbras cameras allow unauthenticated firmware updates that cause DoS
A local Wi-Fi attacker can keep cameras offline by repeatedly posting to an unauthenticated upgrade endpoint; firmware R.260804 requires authentication.
52
Privileged-pod chain bypassed tenant isolation in anonymized cloud
A regular tenant reached worker-node root on managed Kubernetes v1.25.16+k0s.0; the provider fixed every reported issue.
48
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
76
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
73
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
74
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
76
BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
74
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
76
INTERPOL Serengeti III nets 1,462 arrests and $105 million
Agencies in 21 countries identified 65,929 victims and losses exceeding $385 million from June 29 to August 31.
54
Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole
Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.
74
Interpol operation disrupts nearly 11,000 cybercrime networks in Africa
Serengeti III brought 1,462 arrests, identified 65,929 victims, and recovered more than $105 million.
56
INTERPOL Africa sweep arrests 1,462 and recovers over $105 million
Operation Serengeti III, from June 29 to August 31, linked networks to over $385 million in losses and 65,929 victims.
60
Lazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
74
Lazarus uses ML-KEM to deliver malware in FlashHole attacks
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
74
PHP patches two critical unauthenticated RCE flaws after exploit leak
A public PoC dubbed PHP2Shell targets PHP 5 through 8; backports exist for 7.4, 8.0, and 8.1, but attacks are not confirmed.
84
Lazarus Operation FlashHole targets South Korean organizations
Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.
74
Kaspersky maps cyber risk along a warehouse order path
The paper follows eight fulfillment stages and argues a bad record or compromised WMS can stop shipping.
34
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws
Cyble sensors logged exploitation attempts against about 20 flaws as CISA issued 14 ICS advisories.
68
Trezor Wallets Also Compromised with Implants
Joe Grand found hardware implants in Trezor wallets from unauthorized sellers that used preset seed phrases to steal crypto.
58
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
76
Belarusian hacktivists spent two years inside Russian healthcare network, researchers say
Belarusian Cyber Partisans maintained nearly two years of access to a Russian healthcare network, reading sensitive medical data, researchers say.
60
Microsoft Tracks NeedyMantis Malware Targeting Telecoms and Government Contractors
Microsoft details NeedyMantis, a modular post-compromise malware framework targeting telecoms, government contractors and intergovernmental organizations, linked to China-origin cluster Storm-3069.
72
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft says NeedyMantis malware maintained long-term access after targeted network breaches.
73
Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks
Microsoft uncovers NeedyMantis, a modular backdoor keeping covert access in targeted telecom, university, and government networks.
76
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft details NeedyMantis, modular post-compromise malware used in targeted intrusions linked to China-based operators.
66
MacSync’s New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated
Kaspersky reports MacSync’s new macOS chain uses native loaders, iCloud staging, an infostealer, and a persistent backdoor.
74
MacSync info-stealing malware hides malicious commands in an iCloud calendar
Kaspersky says a new MacSync macOS infostealer hides commands in an iCloud calendar and steals credentials and wallets.
72
New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft
MacSync returned on macOS via fake wallet apps that steal passwords, crypto wallets, and developer credentials.
60
MacSync malware uses public iCloud calendars to deliver new payloads
MacSync macOS infostealer now pulls new payloads from public iCloud calendar events and adds a persistent backdoor.
61
Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.
80
ChatGPT Computer History Feature Creates New Data Theft Risk for macOS Infostealers
OpenAI's ChatGPT Computer History feature creates a new data theft risk by storing user activity in readable Markdown files accessible to malware.
65
PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption
PAYLOAD ransomware crew hijacked Active Directory GPOs to disrupt a Middle East manufacturer's entire Windows domain without encrypting files.
60
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
75
Rust Team Members and Popular Crate Owners Targeted via Video Calls
A social engineering campaign targets Rust developers via video calls to steal credentials and deploy malicious packages.
65
Related CVEs
by mentions- CVE-2022-218947%4.4Secure Boot Security Feature Bypass Vulnerability
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2018-10562100%9.8Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562)
- CVE-2017-0147100%7.5Information Disclosure in Microsoft Windows SMBv1 Server (CVE-2017-0147)
- CVE-2019-1226023%9.8Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4)
- Heap Buffer Overflow in Chrome for Android WebGL
- Use-after-free in Google Chrome Fullscreen enables sandbox escape
- CVE-2024-759144%7.2Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects
Appears with
- Kasperskyvendor · 20
- Microsoftvendor · 18
- Windowsproduct · 8
- MacSyncmalware · 8
- Microsoftorganization · 7
- APT41threat actor · 5
- BlackXmalware · 5
- BlackLotusmalware · 5
- OxiDLLRunnermalware · 5
- macOSproduct · 5
- ClientHubmalware · 4
- Applevendor · 4
- Googleorganization · 4
- Storm-3069threat actor · 4
- TechHubmalware · 4
- Cubridgemalware · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.