Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

2026-10-30T08:51:48Z•395348a2dcb960dfb63903edfbe7ba67b8b56741cbe490e1f5d65a008aecfd6b
CVE-2022-21894CVE-2026-109618CVE-2026-109619APTAPT41Active DirectoryAsiaBaton DropBlackLotusBlackXGroup PolicyIP camerasIoTKonnectivityKubernetesLazarusNetamLoaderPHPUEFI bootkitcloud securitycontainer escapedenial of servicegovernment systemsmacOS infostealerransomwareremote code executiontargeted attackwatering hole

What happened

Kaspersky Securelist reports on recent targeted attacks, vulnerabilities, malware, and enterprise security issues, including NetamLoader activity against customized Asian government Windows environments; a DoS flaw affecting Intelbras IP cameras; a Kubernetes and overlay-network cloud isolation bypass leading to RCE; the APT41 BlackX UEFI bootkit exploiting Baton Drop (CVE-2022-21894); critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619; Lazarus Operation FlashHole; MacSync macOS infostealer activity; and PAYLOAD ransomware abuse of Active Directory Group Policy.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
kaspersky_securelist
Record identifier
395348a2dcb960dfb63903edfbe7ba67b8b56741cbe490e1f5d65a008aecfd6b
Enrichment time
2026-10-30T08:51:48Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.