Severity: High | Priority: 1
This update adds 11 hash signatures for NetamLoader, a stealthy multi-stage loader used by an unidentified advanced threat actor. The actor is targeting a customised Windows 10 build used by government organisations in Asia. The malware arrives as a CAB archive placed in the Windows Update download folder, so it looks like a routine update package. Inside, the attacker abuses a legitimate third-party patch-management tool. A modified configuration file makes the trusted program load a malicious resource file when it starts. The real attack code then runs under the cover of signed, legitimate software. Investigators suspect a supply-chain compromise, because the delivery method has not yet been confirmed.
Once triggered, the malware unpacks itself through a series of encrypted stages that run entirely in memory. One stage disables the Windows Antimalware Scan Interface (AMSI), so other security tools see nothing suspicious. The loader also switches off .NET event tracing, deletes its own files, and clears the related logs, Prefetch entries and registry traces. It then moves its final component into a separate system process, which waits 20 to 40 minutes before making its first contact with the attacker’s server.