Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
2026-10-29T20:51:47Z•3c8d628dd017b8e9dc599f13ce66677feb494686880095a2b59c9122b765719a
CVE-2022-21894CVE-2026-109618CVE-2026-109619APTAPT41Active DirectoryBaton DropBlackLotusBlackXGroup Policy ObjectsIntelbras camerasแบบ? nopeKonnectivityKubernetesLazarusNetamLoaderPAYLOAD ransomwarePHPPHP2ShellUEFI bootkitcloud securitygovernment systemsransomwareremote code executiontargeted attackstenant isolation bypass
What happened
Kaspersky Securelist reports covering significant cybersecurity threats, including APT activity, malware campaigns, UEFI bootkits, ransomware abuse of Active Directory Group Policy, cloud tenant-isolation bypasses, vulnerabilities in PHP and Intelbras cameras, and macOS credential theft. The most immediately severe items are the PHP remote-code-execution vulnerabilities, the Kubernetes/cloud isolation bypass, and the BlackX UEFI bootkit exploiting CVE-2022-21894.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 3c8d628dd017b8e9dc599f13ce66677feb494686880095a2b59c9122b765719a
- Enrichment time
- 2026-10-29T20:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.