Kaspersky details a sophisticated infection chain targeting government entities in Asia via a custom Windows 10 build and the newly documented framework.
Read the technical breakdown of the AppDomainManager injection mechanism and deployment artifacts.
Cybersecurity firm Kaspersky uncovered the case, saying the attack targeted a specially configured version of Windows 10 used exclusively by government agencies in an Asian country. Although the exact country is not officially named, researchers believe it is likely China, which uses a separate, special version of the operating system for government services.
How the trap was set
According to the information released to the public, the material in question was detected in the first half of 2026. It was located in a compressed file that had been placed in a folder where operating system update packages are normally stored.
Researchers suspect that this operation was based on a breach of a trusted external company, whose products are routinely used by organizations. Inside the folder were a total of seven files, including legitimate components of a well-known system management program.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
How artificial intelligence helps negotiate with hackers demanding ransom
↗
The entire process leveraged Windows' internal application startup mechanisms to read settings and secretly execute dangerous components. The previously unknown program that did this job is called NetamLoader.
What do we know about the results?
So far, data from tracking systems shows that only one victim has been identified in Asia.
However, it remains unknown whether the breach ultimately gave the perpetrators access to sensitive information or whether more than one system was affected. The attack has not yet been attributed to any specific group of unknown individuals or government agency.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)