Kaspersky uncovers NetamLoader on Asian government Windows 10 computer

Kaspersky’s GReAT disclosed NetamLoader, a previously unknown .NET malware framework, in a report published Oct. 29, 2026, after detecting it on one computer running a government-only Windows 10 build in an Asian country during the first half of 2026.

Kaspersky identified one victim through KSN telemetry and assesses the target as an Asian government organization because the design fits government-only Windows 10 builds. The malicious code targeted a special Windows 10 build reserved for government bodies in one Asian country. It is not clear if more than one computer was affected or if any sensitive data was stolen.s

Kaspersky has not linked any known threat group to the attack. There is no evidence of backing by a government or of a specific nation-state actor. Researchers still do not know how the CAB archive was delivered, and the first delivery method, upstream compromise points, later payloads, victim countries, and threat actors remain unknown.s

Kaspersky’s probe started in the first half of 2026 after its network flagged a suspicious configuration file inside an archive in a Windows update folder. The malicious package was found inside a CAB archive stored in C:\Windows\SoftwareDistribution\Download\, a folder Windows uses for downloaded updates, during the first half of 2026. The CAB archive sat under a hash-named folder e4537a1762fcafd2fd96bfc825bad34f9db9a24 and contents extracted into C:\Windows\SoftwareDistribution\Download\Install\.s

The archive contained seven files, most legitimate components of Patch My PC and Microsoft-signed modules. It is unknown how the archive arrived on the victim’s machine, and nothing indicates Patch My PC or its distribution systems were compromised.s

Execution began when PatchMyPC-ScriptRunner.exe ran and parsed its config file, which pointed to Microsoft.HostIntegration.Connectors.dll. PatchMyPC-ScriptRunner.exe started with the -updatepackage option and an application ID. The chain used AppDomainManager injection through a modified PatchMyPC-ScriptRunner.exe.config to load arbitrary.NET assemblies at program start.s

XAML-1 is a loader for an embedded payload called XAML-2. That DLL read fabric.config, which directed.NET to parse Resources.resx and launch the first XAML script. Resources.resx alone contained malicious code, storing several encoded, compressed or encrypted payloads including XAML files,.NET assemblies and JSON data. XAML-2-2 contained a.NET 1 Loader and a JSON-1 payload carrying C2 server configuration and a Base64-encoded.NET 2 Plugin.s

.NET 1 Loader decrypted and loaded XAML-3, reported status to the C2 server, and deleted extracted malicious files, CLR usage logs, and Windows Prefetch cache files. XAML-3 ran inside dllhost.exe and decoded, decompressed, and loaded the.NET 2 Plugin. It gathered system information from the Windows Registry and verified the host process was dllhost.exe.s

XAML-2-1 bypassed the Antimalware Scan Interface (AMSI). XAML evades detection on 64-bit systems by redirecting the AMSI Scan function pointer. The chain sets COMPlus_ETWEnabled to 0 to suppress.NET ETW provider registration.s

Kaspersky said the infection chain achieves the same result as DLL sideloading by running malicious code inside a legitimate application’s process to avoid detection. The activity looks like a standard OS update or patch component and shows no prominent user interface. Kaspersky observed no lateral movement to another host because dllhost.exe is a separate process on the same endpoint.s

After activation, the framework reaches an attacker-controlled server to fetch more instructions and configuration updates. The C2 domain openaigpt4v[.]com sits behind Cloudflare and was first seen on Sept. 27, 2023. It delayed first contact with C2 server openaigpt4v[.]com by a random jitter of 20-40 minutes. On a valid response it paused five to six minutes before the next request; on failure it waited 22-28 hours and checked every 10 minutes.s

Network traffic uses AES encryption together with an HMAC check. It searches for a proxy using three different methods. Fetched XAML code executes inside a temporary AppDomain that gets removed later. A timer closes the process after about 28 hours.s

The.NET 1 Loader verifies the current user has administrator rights and fails otherwise. COM objects and TypeConfuseDelegate transfer the XAML payload to dllhost.exe on the same endpoint.s

It deletes specific records from the operating system’s update log and wipes.NET usage logs and Prefetch files. NetamLoader interferes with an anti-malware scanning function and moves execution into a legitimate Windows process to conceal its activity. The loader removes selected lines from an update log kept in the CmitUpdateAgent folder, and Kaspersky says that folder may be tied to a custom government build. The loader deletes or modifies registry states, including registry GUID entries, as part of covering its tracks.s

The first decryption key is built from the program’s command line, so the payload only opens with the right arguments and quietly exits in a sandbox. Reading the Resources.resx object triggers a weakness in the old BinaryFormatter feature that launches the first hidden XAML script. To keep signature scanners from spotting it, the malware cuts sensitive text into tiny pieces.s

Kaspersky products detect the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast., and Trojan.Script.Agent. Securelist hosts the complete technical report and its indicators of compromise.s

Researchers suspect the operation involved a software supply chain attack abusing software delivery or update processes. Kaspersky noted findings strongly suggest a supply-chain attack but it has not observed the initial delivery.s

Signs point to China as the likely target because Microsoft sells a bespoke build named Windows 10 China Government Edition to the Chinese government and state-owned entities. Bloomberg reported in August that China’s Ministry of State Security told some agencies to drop the Government Edition for Chinese-made Linux distributions because of data security concerns. Kaspersky concluded that countries building core software platforms often prioritize operating systems above databases, middleware, and cloud services.s

Sergey Lozhkin, head of Kaspersky GReAT Research Center, APAC& META, said operating systems are often where technological sovereignty starts. “Technological sovereignty has become a priority for many governments, and operating systems are often where it starts.” Researchers said the malware’s familiarity with parts of a government-specific Windows system suggested the attackers knew their target’s technology in detail. Researchers said the incident highlights security risks for custom government operating systems.s

The Global Research and Analysis Team (GReAT) was established in 2008 and consists of more than 35 experts working globally. Kaspersky showed its findings at the Security Analyst Summit 2026 held in Bali.s

Kaspersky recommends auditing software update channels, monitoring update directories for unexpected executables and config files, and restricting third-party management tools to approved locations. Kaspersky recommends centralizing log collection outside endpoints because NetamLoader deletes local logs. Kaspersky’s Threat Intelligence Services provide access to current threat feeds and behavior-based indicators of compromise along with threat hunting reports.s

Kaspersky recommends Kaspersky Next EDR Expert to detect stealthy endpoint behavior such as signed programs loading code via modified configuration files. Kaspersky recommends monitoring network traffic with Kaspersky Anti Targeted Attack (KATA) to spot infrequent encrypted connections to unfamiliar external servers behind content delivery networks.s

Kaspersky did not capture what the C2 server sent back in response to the malware’s first contact. Long delays between C2 contacts can leave short monitoring sessions that give little network activity to examine, Kaspersky said.s