NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

Severity

Medium

Detail

Researchers from Kaspersky have disclosed a sophisticated cyber espionage campaign targeting government organizations in Asia through a previously undocumented malware framework named NetamLoader. The malware was discovered during the first half of 2026 and specifically targeted a customized Windows 10 build used exclusively by government entities. The operation utilized advanced .NET assembly-loading techniques, multi-stage payload execution, and stealth mechanisms designed to evade detection and forensic analysis.

The attack employed a malicious Windows Cabinet (CAB) archive that was placed within the Windows update package directory, allowing the malware to blend into legitimate operating system update activities. Researchers suspect the operation may have involved a supply chain compromise, although the initial infection vector remains unknown.

Analysis revealed that the malware leverages AppDomainManager Injection, a .NET execution hijacking technique that allows malicious assemblies to execute within trusted application processes, functioning similarly to DLL sideloading while reducing the likelihood of detection.

The campaign has not been attributed to any known threat actor. However, telemetry data identified at least one victim in Asia, and researchers assess that the malware was specifically designed to target a government-focused Windows 10 edition.

How?

The attack begins when a malicious CAB archive is placed within the Windows update package repository under the Windows SoftwareDistribution directory. The archive contains a mixture of legitimate files associated with Patch My PC software and malicious configuration files designed to initiate the infection chain.

Execution starts when PatchMyPC-ScriptRunner[.]exe is launched. The malware abuses a malicious PatchMyPC-ScriptRunner[.]exe[.]config file to perform AppDomainManager Injection, causing the legitimate process to load Microsoft[.]HostIntegration[.]Connectors[.]dll. The DLL subsequently parses fabric[.]config and loads Resources[.]resx, which contains multiple layers of encoded, compressed, and encrypted payloads, including XAML files, .NET assemblies, and JSON configuration data.

The second stage of the infection chain utilizes several loaders to decrypt and assemble additional payloads in memory while simultaneously bypassing the Windows Antimalware Scan Interface (AMSI). The malware then deploys additional .NET components that establish communications with attacker-controlled infrastructure, collect host information, and prepare the environment for follow-on payload execution.

As part of its execution process, the malware launches its final payload inside the legitimate Windows process dllhost.exe. The payload gathers system information, loads command-and-control configuration data, and establishes communication with the domain openaigpt4v[.]com. To reduce detection, the malware introduces random delays ranging from 20 to 40 minutes before initiating outbound communications and subsequently enters a periodic polling cycle to retrieve and execute additional payloads.

The malware also incorporates defense-evasion mechanisms designed to hinder forensic investigations. Researchers observed attempts to remove malicious files, delete Common Language Runtime (CLR) usage logs, and clear Windows Prefetch artifacts after execution, reducing the availability of evidence on compromised systems.

Conclusion

The discovery of NetamLoader highlights the increasing sophistication of cyber espionage campaigns targeting government environments. Through the use of AppDomainManager Injection, multi-stage encrypted payloads, AMSI bypass techniques, and memory-resident execution, the malware demonstrates a strong emphasis on stealth and persistence.

The suspected use of supply chain compromise methods and the targeting of a government-specific Windows platform indicate a highly targeted operation designed to evade traditional detection mechanisms. Organizations should prioritize monitoring of .NET execution activity, abnormal update-related file placements, and suspicious command-and-control communications to reduce the risk posed by similar advanced threats.

Source

https://thehackernews.com/2026/11/netamloader-malware-targets-government.html