NetamLoader, a new XAML-based .NET loader, points to a supply chain attack on a custom Windows build used by government entities in Asia.
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
NetamLoader Hides in Windows Update Folder in Suspected Supply Chain Attack on Asian Government
TL;DR In the first half of 2026, Kaspersky found a malicious CAB archive sitting in a Windows update download folder. It led to NetamLoader, a new .NET loader built on XAML markup. Kaspersky says the evidence "strongly indicates a supply-chain attack" on a custom Windows build used only by Asian government bodies. What happened The trail began with a Kaspersky Security Network alert on a single .config file.
securityonline.info
October 30, 2026 at 1:26 AM
NetamLoader, a new XAML-based .NET loader, points to a supply chain attack on a custom Windows build used by government entities in Asia.
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
NetamLoader, a new XAML-based .NET loader, points to a supply chain attack on a custom Windows build used by government entities in Asia.
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
NetamLoader Hides in Windows Update Folder in Suspected Supply Chain Attack on Asian Government
TL;DR In the first half of 2026, Kaspersky found a malicious CAB archive sitting in a Windows update download folder. It led to NetamLoader, a new .NET loader built on XAML markup. Kaspersky says the evidence "strongly indicates a supply-chain attack" on a custom Windows build used only by Asian government bodies. What happened The trail began with a Kaspersky Security Network alert on a single .config file.
securityonline.info
October 30, 2026 at 1:26 AM
NetamLoader, a new XAML-based .NET loader, points to a supply chain attack on a custom Windows build used by government entities in Asia.
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
#NetamLoader #SupplyChainAttack #APT #XAML #DotNet #AMSIBypass #Kaspersky #Cybersecurity
Attackers exploit Windows Bind Links to evade EDR detection, redirecting trusted paths to malicious files. #WindowsSecurity #EDREvasion #CyberSecurity #BindLinks #AMSIBypass #AppLocker thedailytechfeed.com/windows-bind...
July 20, 2026 at 3:48 PM
Attackers exploit Windows Bind Links to evade EDR detection, redirecting trusted paths to malicious files. #WindowsSecurity #EDREvasion #CyberSecurity #BindLinks #AMSIBypass #AppLocker thedailytechfeed.com/windows-bind...
Ghosting AMSI: Cutting RPC to Disarm AV
By hijacking NdrClientCall3, this technique bypasses AMSI by intercepting RPC calls, making AV scans ineffective without patching AMSI.
https://medium.com/@andreabocchetti88/ghosting-amsi-cutting-rpc-to-disarm-av-04c26d67bb80
#AMSIBypass #RPCExploitation
By hijacking NdrClientCall3, this technique bypasses AMSI by intercepting RPC calls, making AV scans ineffective without patching AMSI.
https://medium.com/@andreabocchetti88/ghosting-amsi-cutting-rpc-to-disarm-av-04c26d67bb80
#AMSIBypass #RPCExploitation
April 30, 2025 at 5:30 AM
Ghosting AMSI: Cutting RPC to Disarm AV
By hijacking NdrClientCall3, this technique bypasses AMSI by intercepting RPC calls, making AV scans ineffective without patching AMSI.
https://medium.com/@andreabocchetti88/ghosting-amsi-cutting-rpc-to-disarm-av-04c26d67bb80
#AMSIBypass #RPCExploitation
By hijacking NdrClientCall3, this technique bypasses AMSI by intercepting RPC calls, making AV scans ineffective without patching AMSI.
https://medium.com/@andreabocchetti88/ghosting-amsi-cutting-rpc-to-disarm-av-04c26d67bb80
#AMSIBypass #RPCExploitation