Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
2026-10-30T08:51:48Z•395348a2dcb960dfb63903edfbe7ba67b8b56741cbe490e1f5d65a008aecfd6b
CVE-2022-21894CVE-2026-109618CVE-2026-109619APTAPT41Active DirectoryAsiaBaton DropBlackLotusBlackXGroup PolicyIP camerasIoTKonnectivityKubernetesLazarusNetamLoaderPHPUEFI bootkitcloud securitycontainer escapedenial of servicegovernment systemsmacOS infostealerransomwareremote code executiontargeted attackwatering hole
What happened
Kaspersky Securelist reports on recent targeted attacks, vulnerabilities, malware, and enterprise security issues, including NetamLoader activity against customized Asian government Windows environments; a DoS flaw affecting Intelbras IP cameras; a Kubernetes and overlay-network cloud isolation bypass leading to RCE; the APT41 BlackX UEFI bootkit exploiting Baton Drop (CVE-2022-21894); critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619; Lazarus Operation FlashHole; MacSync macOS infostealer activity; and PAYLOAD ransomware abuse of Active Directory Group Policy.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 395348a2dcb960dfb63903edfbe7ba67b8b56741cbe490e1f5d65a008aecfd6b
- Enrichment time
- 2026-10-30T08:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.