NetamLoader Malware Targets Customized Windows 10 Systems Intended for Asian Government Entities

A previously unidentified threat actor deployed a sophisticated, multi-stage .NET malware-loading framework against a customized Windows 10 environment intended for government entities in Asia. The operation combined legitimate Microsoft-signed components, AppDomainManager injection, unsafe deserialization, XAML execution, defense evasion and encrypted command-and-control capabilities.

Security Research | Malware Analysis

Overview

NetamLoader is a previously undocumented .NET assembly-loading framework discovered by Kaspersky during the first half of 2026. The malware was identified within a suspicious Windows Cabinet (CAB) archive stored in a Windows update-package directory on an affected system in Asia.

The investigation revealed that the malware exploited weaknesses in legitimate .NET configuration-processing and deserialization mechanisms. Rather than relying on an obviously malicious executable, the attack used a legitimate application together with a Microsoft-signed assembly to initiate an extensive chain of encrypted and compressed payloads.

The initial execution process involved PatchMyPC-ScriptRunner.exe, a legitimate component associated with the Patch My PC endpoint-management platform. Its accompanying configuration file caused the .NET runtime to initialize Microsoft.HostIntegration.Connectors.dll, a Microsoft-signed assembly.

The attackers abused the assembly's configuration-processing behavior to read attacker-crafted fabric.config and Resources.resx files. These resources eventually activated multiple XAML-based payloads and additional .NET loaders.

The final malware component was designed to collect host information, identify proxy settings, construct encrypted HTTPS requests and retrieve additional XAML instructions. It was configured to contact openaigpt4v[.]com. The published investigation describes this communication capability but does not conclusively establish a successful C2 exchange for the analyzed victim.

Background

Government-oriented operating system deployments may include specialized software, administrative utilities and customized update-management mechanisms. These environments can create opportunities for attackers who understand how legitimate software handles configuration files and trusted dependencies.

NetamLoader came to light when Kaspersky Security Network detected a suspicious application configuration file employing AppDomainManager injection. The file was located inside a CAB archive under the Windows SoftwareDistribution directory.

The analyzed package contained legitimate Patch My PC components and Microsoft-signed assemblies. Most of the extracted files did not contain malicious executable code. Instead, the attacker-controlled resource file and the crafted configuration chain activated the malicious payload.

Files Found in the CAB Archive

The presence of legitimate software in the archive does not prove that Patch My PC or Microsoft distribution infrastructure was compromised. A supply-chain attack was suspected, but the initial delivery mechanism was not observed.

Malware and Technique Details

Technical Profile

NetamLoader's attack chain includes unsafe deserialization weaknesses and configuration-processing abuse. Although these behaviors involve security weaknesses, the published investigation did not assign a specific CVE to the observed attack. Therefore, no campaign-wide CVSS or EPSS score is provided.

Visual Attack Flow

The following diagram summarizes the reported malware execution chain, from the suspicious update-package archive through .NET resource loading, XAML execution, defense evasion and the final remote-tasking functionality.

C2 Timing Behavior

These timing values describe the malware's implemented configuration and code behavior. They are not proof that a successful C2 session occurred on the observed system.

Attack Methodology (NetamLoader Infection Chain)

Indicators of Compromise (IOCs)

The following indicators and host artifacts are associated with the published NetamLoader analysis. Network addresses are defanged to prevent accidental navigation.

Network Indicators

File Hash Indicators (MD5)

Reported File Locations

Behavioral Detection Opportunities

MITRE ATT&CK Coverage

The following MITRE ATT&CK techniques map to the behavior described in the NetamLoader research. These mappings represent analytical classifications rather than attribution to a specific named threat group.

N/A indicates that no applicable technique was established by the available investigation for that tactic. It does not imply that the threat actor lacked the capability. The command-and-control mappings describe implemented malware functionality, not independently confirmed successful communication.

Mitigation & Recommended Actions

Organizations operating sensitive Windows environments should prioritize software integrity validation, configuration monitoring, runtime detection and controlled network communications. The following measures address techniques associated with NetamLoader's loading framework.