NetamLoader malware uses .NET injection to target Asian government Windows systems

Cybersecurity researchers at Kaspersky have revealed a highly sophisticated malware campaign targeting government organizations in Asia. Detected in the first half of 2026, the attack deploys a previously undocumented .NET assembly-loading framework known as NetamLoader. The intrusion specifically targets a custom Windows 10 build used exclusively by government entities, suggesting a focused and high-value operation.

What happened

The malicious artifact was discovered packaged inside a Windows cabinet archive (CAB) file located in a directory typically reserved for Windows operating system update packages. Kaspersky suspects the operation involved a supply chain attack, where threat actors compromised a trusted third-party vendor to gain access to downstream users. While the exact delivery vehicle for the CAB archive remains unknown, the placement within system update folders indicates an attempt to blend in with legitimate administrative processes.

The attack has not been attributed to any specific threat actor or group. It is also unclear whether the intrusion compromised more than one system or if sensitive information was successfully exfiltrated. Telemetry data identified a single victim in Asia, though the specific country was not disclosed. Signs point toward China, as Microsoft offers a bespoke Windows 10 China Government Edition for state-owned entities. This aligns with recent reports that Chinese agencies are moving away from foreign operating systems due to data security concerns.

How it works

NetamLoader employs a two-stage infection chain that leverages AppDomainManager injection, a technique that hijacks the .NET Framework’s application-domain initialization to execute arbitrary code. This method allows malicious code to run inside a legitimate application’s process, similar to DLL sideloading, helping it evade detection. The CAB archive contains seven files, including legitimate components from Patch My PC endpoint management software. Only one file, "Resources.resx," contains malicious code, while the others serve as decoys or loaders.

The execution begins when "PatchMyPC-ScriptRunner.exe" abuses AppDomainManager injection to parse its configuration file, triggering the loading of "Microsoft.HostIntegration.Connectors.dll." This component then parses "fabric.config" to load "Resources.resx," which holds multiple layers of encoded, compressed, or encrypted payloads. These payloads include XAML files, .NET assemblies, and JSON data, which are decoded and loaded sequentially. The final stage involves a .NET plugin that gathers system information, communicates with a command-and-control server at "openaigpt4v[.]com," and executes further instructions fetched from the server.

Key details

• Target: Custom Windows 10 builds used exclusively by government entities in Asia.
• Detection: First half of 2026 by Kaspersky researchers.
• Technique: AppDomainManager injection to load arbitrary .NET assemblies within legitimate processes.
• Payload Structure: Multi-layered encoding using XAML files, .NET assemblies, and JSON data stored in "Resources.resx."
• Evasion: Deletes malicious files, CLR usage logs, and Windows Prefetch cache to cover tracks; bypasses AMSI using XAML-2-1.
• C2 Communication: Uses "openaigpt4v[.]com" with jitter delays of 20-40 minutes before initial contact and periodic polling loops.

Why it matters

For software engineers and security professionals, this campaign highlights the risks associated with complex dependency chains and legitimate tooling. By embedding malware within recognized endpoint management software like Patch My PC, attackers exploit trust in established utilities. This makes traditional signature-based detection less effective, as the surrounding files are genuine and only specific configuration files trigger the malicious behavior. Developers must recognize that supply chain compromises can manifest through seemingly benign updates or configuration changes.

The use of AppDomainManager injection demonstrates a deep understanding of the .NET runtime environment. This technique allows attackers to execute code without creating new processes, making behavioral analysis more challenging. For teams building internal tools or managing enterprise software, this underscores the need for rigorous integrity checks on configuration files and dependencies. Even if the binary executables are signed and verified, malicious logic can be injected through configuration mechanisms that are often overlooked in standard security audits.

What you can do

• Monitor directories like C:\Windows\SoftwareDistribution\Download for unexpected CAB archives or configuration files.
• Implement strict integrity verification for all .config files and resources loaded by .NET applications.
• Review and restrict AppDomainManager initialization settings to prevent unauthorized assembly loading.
• Deploy endpoint detection and response (EDR) solutions capable of analyzing in-memory .NET assembly loading behaviors.
• Audit third-party vendor security practices and limit trust boundaries for software updates.
• Check for unusual network traffic to domains resembling legitimate services, such as "openaigpt4v[.]com."