VULNpocalypse
HighSupply chainMonitoring

NetamLoader malware hits custom government Windows 10 builds in Asia via a suspected supply chain attack

Kaspersky found NetamLoader, a new .NET loader hidden in a Windows update folder on a government-only Windows 10 build in Asia, with no attribution yet.

Published
Updated
Exploitation
Yes, Kaspersky identified one victim in Asia through its threat monitoring network in the first half of 2026

What happened

Kaspersky researchers identified an attack on a customized Windows 10 build used exclusively by government organisations in an Asian country. The attackers used legitimate software components to deploy NetamLoader, a previously unknown malware framework that can receive and run additional code while hiding its activity (ETCISO). Kaspersky has not linked the attack to any known threat group (Securelist).

Discovery. In the first half of 2026, Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load arbitrary .NET assemblies. The file was packaged inside a CAB archive in the directory that stores Windows update packages, at C:\Windows\SoftwareDistribution\Download\ (Securelist). Most of the archive was legitimate, including components of the third-party patch management tool Patch My PC and Microsoft-signed .NET assemblies (Securelist).

Archive contents. The CAB holds seven files, which are extracted to C:\Windows\SoftwareDistribution\Download\Install\. They are fabric.config, Microsoft.HostIntegration.Connectors.dll, PatchMyPC-Enum.dll, PatchMyPC-Models.dll, PatchMyPC-ScriptRunner.exe, PatchMyPC-ScriptRunner.exe.config and Resources.resx. Only Resources.resx contains malicious code (The Hacker News).

Infection chain.

  • Kaspersky observed PatchMyPC-ScriptRunner.exe running with the arguments -updatepackage and -applicationid (Securelist).
  • Its .config file abuses AppDomainManager injection to load the Microsoft-signed Microsoft.HostIntegration.Connectors.dll. That module reads fabric.config, which points to Resources.resx (Securelist).
  • Resources.resx holds a Base64-encoded object serialized with BinaryFormatter. Parsing it triggers a deserialization issue (a TypeConfuseDelegate attack) that calls XamlReader.Parse() and loads the first XAML payload (Securelist).
  • Further layers of XAML, .NET assemblies and JSON are encoded, compressed or encrypted and loaded one after another. One XAML component bypasses AMSI, the Antimalware Scan Interface (The Hacker News).
  • A .NET loader deletes the files extracted from the CAB, CLR usage logs and Windows Prefetch cache files to cover its tracks. A later stage runs inside dllhost.exe (The Hacker News).
  • The framework also removes selected entries from the update component logs (ETCISO).

Command and control. The configuration Kaspersky analysed sets a random delay of 20 to 40 minutes before the first contact with the C2 server, reported as openaigpt4v[.]com. If the server gives no valid response, the malware waits 22 to 28 hours before trying again. After a valid response it pauses 5 to 6 minutes before the next request (The Hacker News). These delays limit the network activity visible in short monitoring sessions (ETCISO).

Supply chain angle. The location and contents of the archive suggest a possible supply chain attack involving software delivery or update processes. Researchers did not establish how the archive reached the victim, and found no evidence that Patch My PC or its distribution systems were compromised (ETCISO).

Scope and attribution. Kaspersky telemetry identified a single victim in Asia. It is not clear whether more than one system was compromised or whether sensitive data was stolen (The Hacker News). The targeted country was not disclosed. The Hacker News says signs point to China and the Windows 10 China Government Edition, which is that outlet’s inference and not a Kaspersky confirmation (The Hacker News).

Am I affected?

  • Most likely affected: government organisations in Asia that run a customized, government-only Windows 10 build. Only one victim has been confirmed.
  • Other Windows 10 environments: the sources describe NetamLoader as tailored to the targeted operating system, so exposure elsewhere is not confirmed. The artifacts and behaviors below are still cheap to check for.
  • Patch My PC users: no compromise of Patch My PC or its distribution systems has been found. The attackers used legitimate Patch My PC components, so the presence of those files alone does not mean infection. Look for them in unexpected places or combined with the other indicators below.
  • Indicators to check:
  • A CAB archive with a long hex name in C:\Windows\SoftwareDistribution\Download\, and an Install\ subfolder holding the seven files listed above.
  • PatchMyPC-ScriptRunner.exe launched with -updatepackage from that path.
  • A .config file with appDomainManagerType and appDomainManagerAssembly entries pointing to Microsoft.HostIntegration.Connectors.
  • dllhost.exe making outbound connections to unfamiliar servers.
  • Gaps in .NET usage logs, Prefetch files or update component records.
  • Detection names: Kaspersky products detect the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.* (Securelist).

Kaspersky’s technical report on Securelist lists file hashes, file paths and domains and IPs. This advisory does not reproduce hashes, so use that report for matching.

What to do now

  1. Search endpoints for the file names, the SoftwareDistribution\Download paths and the PatchMyPC-ScriptRunner.exe command line described above. Compare any hits against the indicators in the Securelist report.
  2. Audit software update channels. Watch update directories for unexpected executables and configuration files, verify the origin of update packages, and restrict third-party management tools to approved locations (ETCISO).
  3. Alert on signed programs that load code through modified configuration files, Windows processes that connect to unfamiliar external servers, and attempts to interfere with anti-malware scanning.
  4. Hunt for infrequent or encrypted connections to unfamiliar servers, including those routed through content delivery networks. Treat long gaps between connection attempts (22 to 28 hours in the analysed sample) as a hunting signal.
  5. Centralise log collection outside individual endpoints, because the malware deletes local records. Alert on unexplained gaps in system caches, .NET usage logs and update component records.
  6. Block and search historical DNS and proxy logs for openaigpt4v[.]com, and check the Securelist report for the full list of domains and IPs.
  7. Update endpoint protection so the Kaspersky signatures above, or your vendor’s equivalents, are active. A vendor patch or fix is not confirmed in the sources, since this is a malware campaign and not a software vulnerability.
  8. If you find a match, isolate the host and preserve off-host logs and disk images before cleanup. The malware removes evidence of its own activity.

Sources