NetamLoader Malware Targets Asian Government Windows 10 Systems via .NET Injection

Overview

Kaspersky has disclosed NetamLoader, a previously undocumented .NET assembly-loading framework used in what it calls a "highly sophisticated infection chain" against government organizations in Asia. The sample, detected in the first half of 2026, targeted a custom Windows 10 build used exclusively by government entities. Kaspersky telemetry identified a single victim; it is unclear whether other systems were compromised or data was stolen.

Delivery

The payload arrived as a Windows CAB archive in a directory used for Windows update packages:

C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24

Contents were extracted to C:\Windows\SoftwareDistribution\Download\Install\. The exact delivery vector is unknown; a supply chain compromise is suspected but unconfirmed. The CAB holds seven files, four of them legitimate Patch My PC components. Only Resources.resx carries malicious content.

Infection Chain

1. Launchpad. PatchMyPC-ScriptRunner.exe is abused through AppDomainManager injection: its .config file makes it load Microsoft.HostIntegration.Connectors.dll.
2. Stage 2. That DLL reads fabric.config and uses it to load Resources.resx, which holds layered encoded, compressed, or encrypted payloads (XAML, .NET assemblies, JSON).
3. Layers. Nested XAML stages bypass AMSI and unpack a .NET loader plus a JSON blob containing the C2 configuration and a Base64-encoded .NET plugin.
4. Execution. A XAML stage runs inside dllhost.exe and loads the plugin.
5. Cleanup. The loader deletes the extracted CAB files, CLR usage logs, and Prefetch files.

NetamLoader Behavior

• Loads its C2 configuration and collects system information from the registry
• Verifies its host process is dllhost.exe
• Waits a random 20–40 minute delay before the first C2 request
• Polls C2 for XAML files and runs each in an isolated AppDomain
• After a valid response it pauses 5–6 minutes; otherwise it pauses 22–28 hours, checking every 10 minutes whether that time has elapsed

Attribution

No known threat actor has been linked. The targeted country was not disclosed. The Hacker News notes China as a likely candidate, since Microsoft offers a "Windows 10 China Government Edition", but this is speculation. Bloomberg reported in August 2026 that China's Ministry of State Security told some agencies to stop using that edition over data security concerns.

Indicators of Compromise

File hashes are in Kaspersky's original report.

Defensive Takeaways

• Hunt for PatchMyPC-ScriptRunner.exe running from SoftwareDistribution\Download paths, or with an unexpected .config file.
• Alert on dllhost.exe making outbound HTTP(S) connections to uncommon domains.
• Monitor for AppDomainManager injection via .config files next to signed binaries.
• Block the C2 domain and review software distribution and patching tooling for tampering.

Sources

• The Hacker News