Detecting sophisticated new malware attacking the Windows operating system
Executive Briefing
Synthesized and verified with gemini-2.0-flash-thinking-exp
“A targeted cyber attack campaign targeting a version of Windows 10 customized specifically for gover”
Key Takeaways
- 1.A targeted cyber attack campaign targeting a version of Windows 10 customized specifically for government agencies in an Asian country has just been discovered.
- 2.According to security firm Kaspersky on November 5, the attack uses a completely new malicious code framework that has never been recorded before, called NetamLoader.
- 3.Notably, instead of directly attacking with strange files that are easily blocked by virus scanning software, bad guys have applied the tactic of "borrowing" legitimate components in the system to activate malicious code.
A targeted cyber attack campaign targeting a version of Windows 10 customized specifically for government agencies in an Asian country has just been discovered. According to security firm Kaspersky on November 5, the attack uses a completely new malicious code framework that has never been recorded before, called NetamLoader.
Notably, instead of directly attacking with strange files that are easily blocked by virus scanning software, bad guys have applied the tactic of "borrowing" legitimate components in the system to activate malicious code.
"Borrow" legal software to hide yourself
The incident started in the first half of 2026 when security experts discovered an unusual configuration file mixed in the Windows update folder. Included with this file are completely "clean" programs, including authentic Microsoft digitally signed software components and third-party patch management tools.
By sophisticatedly interfering with backend support files, hackers turned these trusted programs into "tools" for downloading and executing malicious commands.
Initial analysis shows that this is most likely a supply chain attack - that is, targeting the distribution or packaging process of software updates instead of penetrating computers in the traditional way.
In particular, this malicious code is "tailor-made" specifically for the specific operating systems of public authorities: it has the ability to automatically delete update history records to eliminate all traces of investigation.
Multi-layer stealth and "wait patiently" strategy
Cyber security experts evaluate NetamLoader as an extremely dangerous cyber espionage tool because of its sophisticated camouflage techniques. After bypassing protection layers with multiple layers of encryption and data compression, the malicious code will embed itself into legitimate running Windows processes.
Not only does it disable the operating system's malware scanning feature, NetamLoader also proactively deletes data files that can help experts reconstruct the attack scene.
To bypass conventional network traffic monitoring systems, the malware uses a very annoying time spacing mechanism: after activation, it will wait 20 - 40 minutes before sending the first connection signal to the remote control server.
If it does not receive a response, it will "hibernate" for another 22 - 28 hours before trying again. This communication cycle lasting dozens of hours makes it virtually impossible for short-term network monitoring tools to detect any abnormalities.
Maximum:
1500 characters There are currently no comments. Be the first to comment
Attribution & Original Source
Synthesized and verified from Tuổi Trẻ Nhịp Sống Số. All copyrights and intellectual property belong to the original publication.
