Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
2026-10-29T08:51:45Z•36f785bde71682129e8a3b3dc3fb0eb8d6516a70b2e001b1660b57dd28a5c107
CVE-2022-21894CVE-2026-109618CVE-2026-109619APTAPT41Active DirectoryBlackLotusBlackXGroup PolicyIP camerasKonnectivityKubernetesLazarusMacSyncNetamLoaderPHPPHP2ShellRCEUEFI bootkitcloud isolation bypasscrypto stealerdenial of servicemacOS malwareransomwarewatering hole
What happened
Kaspersky Securelist feed covering targeted attacks, vulnerabilities, malware, ransomware, cloud isolation bypasses, UEFI bootkits, and AI and warehouse security. Notable items include APT41's BlackX UEFI bootkit exploiting CVE-2022-21894, critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619, Lazarus Operation FlashHole, NetamLoader activity, MacSync macOS theft malware, and PAYLOAD ransomware abusing Active Directory Group Policy.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 36f785bde71682129e8a3b3dc3fb0eb8d6516a70b2e001b1660b57dd28a5c107
- Enrichment time
- 2026-10-29T08:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.