Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

Resumen del corpus

An unknown Advanced Persistent Threat (APT) utilized a sophisticated infection chain involving the NetamLoader framework to target a customized Windows 10 OS used by governments in Asia. The attack leveraged AppDomainManager injection to load malicious .NET assemblies, which in turn exploited a deserialization vulnerability in a configuration file to load layered XAML payloads. These payloads were designed to bypass anti-malware scanning and establish a covert command and control (C2) channel using AES encryption for network traffic.