NetamLoader: .NET Injection Attack Hits Government Windows 10 Build in Asia
Cybersecurity researchers have disclosed a sophisticated multi-stage intrusion that targeted a government-only Windows 10 build in Asia using a previously undocumented .NET assembly-loading framework dubbed NetamLoader. Kaspersky researchers who investigated the artifact say the sample was discovered in the first half of 2026 and was packaged inside a Windows cabinet (CAB) archive placed in a directory normally used for Windows update packages. The operation appears to have used AppDomainManager injection…