- Published on
NetamLoader Malware Targets Government Windows 10 Systems in Asia via.NET Injection
- Authors
- Name
- DeepHorus
Kaspersky researchers have disclosed NetamLoader, a previously undocumented .NET assembly-loading framework used in a highly sophisticated infection chain against government organizations in Asia. The artifact was detected in the first half of 2026 on a custom Windows 10 build used exclusively by government entities. The attack has not been attributed to a known threat actor, and it remains unclear whether multiple systems were compromised or sensitive data was stolen.
The sample was packaged inside a Windows cabinet archive placed in C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24, a directory for Windows update packages. Its contents were extracted into C:\Windows\SoftwareDistribution\Download\Install\. Kaspersky suspects a supply chain attack in which a trusted third-party vendor was compromised, though the exact delivery vehicle remains unknown.
The archive contained seven files. They included legitimate Patch My PC endpoint management components such as fabric.config, Microsoft.HostIntegration.Connectors.dll, PatchMyPC-Enum.dll, PatchMyPC-Models.dll, PatchMyPC-ScriptRunner.exe, and its .config file. According to Kaspersky, only Resources.resx embedded malicious code, which uses AppDomainManager injection to load arbitrary .NET assemblies.
In the first stage, PatchMyPC-ScriptRunner.exe parses its .config file and loads Microsoft.HostIntegration.Connectors.dll. That DLL reads fabric.config and loads Resources.resx, which contains layers of encoded, compressed, or encrypted XAML files, .NET assemblies, and JSON data. This chain lets attackers execute code inside a legitimate process and evade routine monitoring.
The payloads include XAML-1, a loader for XAML-2, which initializes the second stage. XAML-2-1 bypasses the Antimalware Scan Interface, while XAML-2-2 carries a .NET module and JSON-1. JSON-1 stores command-and-control server configuration and a Base64-encoded .NET plugin plus templates for XAML-3.
The .NET 1 Loader decrypts, assembles, and loads XAML-3, reports status to the C2 server, and deletes malicious files, CLR usage logs, and Windows Prefetch cache files. The final XAML-3 payload runs within the legitimate process. Security teams should scrutinize update directories, AppDomainManager abuse, and unexpected Patch My PC components.
