The Malware Newsletter Round 122 from Security Affairs appeared on Nov. 8, 2026, detailing how an unidentified advanced persistent threat (APT) used NetamLoader against Asian governments’ Windows 10 operating systems. The issue gathers leading malware research and reporting from across the international landscape, and it also covers DarkBlinders, described as an active espionage campaign.
The actor behind the NetamLoader intrusions remains unidentified. Shield53 says custom government builds often lag behind mainstream patch schedules and draw little scrutiny, which makes them attractive targets, and urges defenders to check update-channel integrity, since a hijacked auto-update turns patching into an attacker’s delivery path.
The newsletter takes up the drive to shut down the XCPE botnet. Google and its partners took down the XCPE backdoor after it enlisted more than 1.3 million set-top boxes as bots. Investigators allege that Android TV box maker Videostrong built the operation to carry out ad fraud and proxy abuse.
Sekoia links a watering hole campaign, in which attackers compromise websites their targets are known to visit, targeting users of iOS and Android to APT29, also tracked as SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes. The firm also ties APT29 to SVR, which it describes as the foreign intelligence service.
Shield53 says attacks target information security developers on GitHub, seeking to poison the software supply chain at its source. The firm also says attackers can use large-language-model abilities to craft phishing lures, hide code with obfuscation, and automate vulnerability discovery, even as those same abilities help defenders triage malware.
Join the discussion