NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

thehackernews.com Nov 1, 2026

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

Curated by Shubham · TechCapsules · Nov 1, 2026

AI-summarised brief · reviewed before publication

Kaspersky researchers have uncovered a sophisticated infection chain that targets a custom Windows 10 build used exclusively by Asian government agencies. The campaign deploys an undocumented .NET assembly‑loading framework, dubbed NetamLoader, delivered inside a Windows cabinet (CAB) archive placed in the system’s SoftwareDistribution folder. The archive contains a “.config” file that leverages AppDomainManager injection to load arbitrary .NET assemblies, effectively sideloading malicious code into legitimate processes. Four of the seven files in the archive belong to Patch My PC, an endpoint‑management tool, while only “Resources.resx” carries malicious payloads. The operation appears to be a supply‑chain attack, though the exact delivery method remains unknown. Kaspersky detected the artifact in early 2026 and identified a single victim, likely in China, where the targeted Windows 10 China Government Edition is in use.

💡 Why It Matters

· It demonstrates that even highly curated, government‑only operating systems are vulnerable to novel .NET injection techniques, exposing critical state infrastructure to covert compromise.

Read full article on thehackernews.com

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

On October 29, malicious code injected into Polymarket’s website hijacked a third‑party DebugBear page‑speed script and used signed‑in traders’ credentials to transfer their positions and funds to a hacker‑controlled wallet. The attack moved roughly $2.64 million worth of POL tokens from 33 wallets in under an hour, after which the funds were quickly split among three addresses. Polymarket identified the breach, removed the compromised script within an hour, cleared caches, reset sessions and paused trading. The company is refunding about $2.7 million to 726 affected wallets and an additional $1.19 million to roughly 5,500 users impacted by the trading pause, totaling $3.9 million in reimbursements. DebugBear confirmed its DNS was compromised but its own systems remain intact. The incident underscores risks of third‑party scripts.

💡 Exploiting a trusted monitoring script let attackers bypass user authentication, exposing a systemic vulnerability in how crypto platforms rely on external code.

thehackernews.com · Nov 1

CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a…

A critical vulnerability identified as CVE‑2026‑112816 allows attackers to impersonate trusted clients in Canonical’s LXD and MicroCloud containers without possessing the client’s private key. The flaw stems from improper verification of certificate chains during mutual TLS authentication: the server validates every certificate presented against its trust store, but only the leaf certificate’s private key is proven, enabling an attacker to attach a trusted client’s public certificate behind their own. Exploitation requires network access to the HTTPS API and the public certificate of a trusted client. Successful abuse grants full cluster control and, for privileged accounts, root access to the host. Affected releases include LXD 4.0.14, 5.0.10, 5.21.8 and 6.9; Canonical has issued snap updates fixing the issue, and Incus released version 7.6.0 with the same patch. No known exploits have been reported.

💡 By bypassing private‑key authentication, the bug lets attackers seize complete control of container clusters, turning a routine TLS misconfiguration into a full‑system takeover vector.

thehackernews.com · Oct 31

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Cloudflare reported that it autonomously mitigated 18.2 million network‑layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, up 38% from the previous quarter. The company logged 8,226 L3 attacks per hour, averaging one every 0.44 seconds, with short‑burst, low‑bandwidth attacks under 10 minutes and 1 Gbps rising 208%. Hyper‑volumetric attacks above 1 Tbps fell 69%, while DNS amplification surged 215%. Targeted sectors included media, IT services, gambling, software, and telecoms, with the U.S., China, Indonesia, the U.K., and Türkiye most affected.

💡 The spike in low‑bandwidth, short‑burst attacks shows attackers shifting tactics to evade detection, underscoring the need for adaptive defense strategies.

thehackernews.com · Oct 31

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure (ICS) flaws to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The vulnerabilities—CVE‑2026‑111357 and CVE‑2026‑118527—were part of a three‑step exploit chain first detailed by Volexity, which combined an authentication bypass (CVE‑2026‑104935, CVSS 8.6), a remote code execution flaw, and a local privilege escalation to achieve unauthenticated root‑level code execution. Threat actor UTA0576 used the chain to harvest credentials, query Active Directory metadata, and locate administrator passwords and BitLocker keys, rather than merely deploying malware. Ivanti released patches for all three CVEs; the authentication bypass fix was already in QA, while the LPE patches were rolled out in the latest release. Federal Civilian Executive Branch agencies must apply the fixes by early November 2026.

💡 The chain demonstrates how attackers can stitch together multiple bugs to bypass authentication entirely, turning routine VPN appliances into gateways for deep network reconnaissance.

thehackernews.com · Oct 31

Why Urgent Security Fixes Aren’t Fixed. Observe, Prove, Act, Confirm Gets Them…

A new approach called Safe Remediation, detailed in a white paper, addresses delays in applying critical security fixes by providing evidence that changes will not disrupt operations. The method follows four stages—Observe, Prove, Act, and Confirm—using existing data from vulnerability scans, IPS logs, and endpoint policies to test and validate proposed actions in a controlled environment. After approval, changes are deployed through existing management tools, and confirmation records verify successful implementation. Across surveyed organizations, the process achieved a 99.5% success rate, blocking over 703 million attacks within a month.

💡 By turning evidence into a mandatory step, the framework reduces the hesitation that keeps patches stalled, ensuring that security updates are applied swiftly without compromising business continuity.

thehackernews.com · Oct 31

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

WordPress Core versions 4.7 through 7.1.3 suffered a remote code execution flaw, identified by a CVSS score of 8.1, that exploits a race condition during full‑package upgrades. Patches were released on October 28, 2026, yet within 24 hours Wordfence logged 62,969 attack attempts, targeting the web‑accessible staging directory “wp‑content/upgrade.” Threat actors poll vulnerable paths such as “setup‑config.php” to hit the narrow execution window. Site owners are urged to upgrade to 7.1.4 immediately and monitor for suspicious PHP files or admin accounts.

💡 The rapid, high‑volume exploitation attempts demonstrate that even short‑lived race conditions can become global threats when attackers coordinate persistent polling. Prompt patching and vigilant monitoring are essential to prevent widespread server compromise.