NetamLoader Malware Targets Asian Government Systems Through Sophisticated .NET Infection Chain

Cybersecurity researchers have uncovered a sophisticated malware infection chain targeting government organizations in Asia. The campaign uses a previously undocumented .NET assembly-loading framework, dubbed NetamLoader, to execute malicious payloads on a customized Windows 10 build reportedly reserved for government use.

The activity was documented by Kaspersky, which detected the malicious artifact during the first half of 2026. Researchers have not attributed the operation to a known threat actor or hacking group. It also remains unclear whether the intrusion extended beyond a single identified victim or resulted in the theft of sensitive information.

Investigators suspect the incident may involve a supply chain compromise, potentially exploiting a trusted third-party vendor to reach downstream systems. However, the initial delivery method has not been confirmed.

NetamLoader Exploits .NET Framework Initialization

The infection began with a Windows Cabinet (CAB) archive discovered inside a directory used to store Windows update packages. The archive contained several files associated with Patch My PC, an endpoint management software product.

The files were placed under the following Windows directory:

C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24

Their contents were subsequently extracted into:

C:\Windows\SoftwareDistribution\Download\Install\

The archive contained seven files, including legitimate software components and configuration files. According to Kaspersky, none of the files except Resources.resx embedded malicious code directly.

The attackers abused AppDomainManager injection, a technique that manipulates the .NET Framework's application-domain initialization process to load arbitrary assemblies when a .NET application starts.

This technique enables malicious code to execute within the context of a legitimate application, potentially making detection more difficult by disguising malicious activity as normal software behavior.

Two-Stage Infection Chain Delivers Multiple Payloads

Kaspersky identified a multistage execution process that progressively decodes, decrypts, and loads malicious components.

Stage 1: Initial Payload Execution

The infection begins when PatchMyPC-ScriptRunner.exe is executed.

The executable processes its associated configuration file, PatchMyPC-ScriptRunner.exe.config, which is manipulated to trigger AppDomainManager injection. This leads to the execution of Microsoft.HostIntegration.Connectors.dll.

The loaded DLL then locates fabric.config in the same directory and uses its contents to load Resources.resx.

The resource file contains multiple layers of encoded, compressed, or encrypted data, including XAML files, .NET assemblies, and JSON payloads. These components are progressively unpacked and loaded as the infection advances.

Stage 2: Payload Decryption and Execution

The second stage consists of several interconnected components that prepare and execute additional payloads.

• XAML-1: Loads an embedded payload identified as XAML-2.
• XAML-2: Initiates the next stage by loading two compressed and Base64-encoded XAML files, XAML-2-1 and XAML-2-2.
• XAML-2-1: Contains functionality designed to bypass the Antimalware Scan Interface (AMSI), a Windows security mechanism used to inspect scripts and other content for malicious activity.
• XAML-2-2: Contains a .NET module called the .NET 1 Loader and a JSON payload identified as JSON-1.
• JSON-1: Stores command-and-control (C2) configuration data in JSON-1-c and a Base64-encoded file identified as the .NET 2 Plugin, alongside compressed and encrypted XAML templates used to construct XAML-3.
• .NET 1 Loader: Decrypts, assembles, and loads XAML-3, communicates execution status to the C2 server, and removes artifacts associated with the initial infection.
• XAML-3: Executes within dllhost.exe and decodes, decompresses, and loads the .NET 2 Plugin.
• .NET 2 Plugin: Collects system information, reads configuration data, and establishes communication with the attackers' infrastructure.

The .NET 1 Loader also attempts to cover the operation's tracks by deleting malicious files extracted from the CAB archive, along with CLR usage logs and Windows Prefetch cache files.

This layered design separates the initial execution mechanism from the later payloads, making the infection chain more complex to analyze and potentially more difficult to detect.

Malware Uses Delayed C2 Communication

After loading, the .NET 2 Plugin checks whether its host process is dllhost.exe and gathers system information from the Windows Registry.

It then waits for a randomized delay of approximately 20 to 40 minutes before making its first request to the command-and-control server, openaigpt4v[.]com.

The malware subsequently enters a recurring polling loop to retrieve XAML files from the server and execute them within an isolated application domain.

According to Kaspersky, the polling interval depends on the server's response:

• Valid response: The malware pauses for approximately five to six minutes before the next request.
• No valid response: It waits approximately 22 to 28 hours, checking every 10 minutes to determine whether the waiting period has elapsed.

These delays can reduce the frequency of suspicious network connections and allow the malware to remain dormant for extended periods when the command-and-control server does not return an expected response.

The ability to retrieve and execute additional XAML payloads also gives the operators flexibility to deliver further functionality without replacing the entire initial infection chain.

Customized Windows Build Raises Questions About the Target

Kaspersky's telemetry identified a single victim in Asia. The malware was specifically designed to target a customized Windows 10 build used by government entities.

Although the researchers did not identify the country, the report suggested that China could be a possible target because Microsoft previously introduced Windows 10 China Government Edition, a customized version intended for Chinese government agencies and state-owned organizations.

The potential connection remains unconfirmed, and the available findings do not establish the victim's identity or nationality.

The discovery also comes amid broader efforts by some governments to reduce reliance on foreign technology. In August 2026, Bloomberg reported that China's Ministry of State Security had instructed certain government agencies to stop using the government edition of Windows in favor of domestically developed Linux distributions.

The report cited data security concerns as a factor behind the instruction.

However, no direct connection between that policy and the NetamLoader operation has been established.

Supply Chain Compromise Remains a Possibility

The presence of legitimate Patch My PC components within the CAB archive has raised suspicions of a potential supply chain attack. Such attacks involve compromising trusted software providers, distribution mechanisms, or dependencies to gain access to organizations that rely on them.

In this case, researchers have not confirmed how the archive reached the victim's system or whether Patch My PC itself was compromised.

The use of legitimate software components, configuration-based loading, encrypted payloads, AMSI bypass functionality, and artifact deletion indicates a carefully structured infection chain.

Nevertheless, the precise initial access vector and the extent of any data theft remain unknown.

Growing Security Challenges for Government Software Ecosystems

The NetamLoader discovery highlights the security challenges associated with highly customized operating systems and software environments used by government organizations.

While custom platforms can provide greater control over software development and deployment, they also require sustained investment in secure maintenance, dependency management, threat monitoring, and incident response.

Kaspersky noted that countries increasingly seek greater technological independence by developing their own operating systems, databases, middleware, and cloud services. However, maintaining the security of an entire technology ecosystem requires substantial resources and long-term operational maturity.

For defenders, the incident reinforces the importance of monitoring unusual files in Windows update directories, verifying software packages and dependencies, investigating suspicious .NET assembly loading, and detecting unexpected activity within legitimate processes such as dllhost.exe.

Until the initial infection method is established, the NetamLoader campaign remains an unresolved case involving a highly sophisticated malware framework, a government-focused target, and a potentially significant supply chain security risk.