NetamLoader Uses .NET Injection Against Government Windows 10 Systems
Kaspersky has disclosed a previously undocumented .NET assembly-loading framework called NetamLoader, detected in an intrusion aimed at a government-only Windows 10 build in Asia. Its telemetry identified one victim in the first half of 2026. The activity has not been attributed to a known group, and Kaspersky said it remains unclear whether more than one system was compromised or whether sensitive data was taken.
The malware was packaged in a Windows cabinet archive and placed in a directory used for Windows operating-system update packages. Kaspersky suspects the operation may have involved a supply-chain attack against a trusted third-party vendor, although the exact delivery method for the CAB archive is unknown.
A staged loader built around legitimate files
The archive was found under C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24, with files extracted to C:\Windows\SoftwareDistribution\Download\Install\. It contained seven files, including four legitimate Patch My PC components, an endpoint-management product. Only Resources.resx contained malicious code.
The first stage starts when PatchMyPC-ScriptRunner.exe runs. Its configuration file abuses AppDomainManager injection, a technique that hijacks .NET Framework application-domain initialization to load arbitrary assemblies when a .NET application starts. The effect resembles DLL sideloading: malicious code runs within the process of a legitimate application.
The injected configuration causes Microsoft.HostIntegration.Connectors.dll to load. That component reads fabric.config from the same directory and then loads Resources.resx. The resource file holds multiple encoded, compressed or encrypted payload layers, including XAML files, .NET assemblies and JSON data.
AMSI bypass, delayed communications and cleanup
In the second stage, an initial XAML loader starts another XAML component that loads two compressed, Base64-encoded XAML files. One is intended to bypass the Antimalware Scan Interface, or AMSI. The other contains a .NET loader and a JSON payload with command-and-control configuration, a Base64-encoded plugin and encrypted XAML templates used to construct the next payload.
The .NET loader decrypts, assembles and loads that payload, reports status to the command-and-control server, and deletes extracted malicious files. Kaspersky said it also removes CLR usage logs and Windows Prefetch cache files. The subsequent XAML component runs inside dllhost.exe and loads the .NET plugin.
The plugin gathers Windows Registry information, checks that its host process is dllhost.exe, then waits a random 20 to 40 minutes before contacting openaigpt4v[.]com. On a valid response, it pauses for five to six minutes before polling again; on failure, it waits 22 to 28 hours while checking every 10 minutes whether that interval has elapsed.
Why customised operating systems remain a security responsibility
Kaspersky said the target was a Windows 10 build customised exclusively for government entities. It did not name the country, but noted that Microsoft offers Windows 10 China Government Edition for Chinese government and state-owned organisations. Kaspersky also observed that countries developing sovereign software platforms must protect the full ecosystem surrounding those platforms.
For security teams, the practical implication is to investigate unexpected CAB content in Windows update directories, anomalous .NET configuration files and legitimate executables loading unfamiliar assemblies. Endpoint-management software and trusted update workflows should be monitored as carefully as other potential paths into sensitive systems.