NetamLoader: .NET Injection Attack Hits Government Windows 10 Build in Asia

Cybersecurity researchers have disclosed a sophisticated multi-stage intrusion that targeted a government-only Windows 10 build in Asia using a previously undocumented .NET assembly-loading framework dubbed NetamLoader. Kaspersky researchers who investigated the artifact say the sample was discovered in the first half of 2026 and was packaged inside a Windows cabinet (CAB) archive placed in a directory normally used for Windows update packages. The operation appears to have used AppDomainManager injection to load arbitrary .NET assemblies and run malicious code inside legitimate processes.

How the malicious package was found

Kaspersky reported that the CAB archive was placed under C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24, with its contents extracted into C:\Windows\SoftwareDistribution\Download\Install\. The exact delivery vehicle that dropped the CAB remains unknown, but its location and contents suggest a supply-chain or update-related compromise, where a trusted vendor’s files were manipulated or substituted to reach downstream government systems.

The components inside the archive

The archive contained seven files, most of which are legitimate components associated with Patch My PC, an endpoint management tool:

• fabric.config
• Microsoft.HostIntegration.Connectors.dll
• PatchMyPC-Enum.dll
• PatchMyPC-Models.dll
• PatchMyPC-ScriptRunner.exe
• PatchMyPC-ScriptRunner.exe.config
• Resources.resx

Only Resources.resx contained the layered malicious payloads; the other files were legitimate binaries used by the loader to trigger execution and parsing.

AppDomainManager injection and initial execution flow

The infection chain is a two-stage process that abuses .NET application initialization:

• PatchMyPC-ScriptRunner.exe is used as the execution pivot and leverages AppDomainManager injection by parsing PatchMyPC-ScriptRunner.exe.config to cause Microsoft.HostIntegration.Connectors.dll to be executed inside the process.
• Microsoft.HostIntegration.Connectors.dll then parses fabric.config in the same directory and loads Resources.resx.
• Resources.resx houses multiple encoded, compressed, or encrypted payloads — XAML templates, .NET assemblies, and JSON — which are decoded and loaded by the components that follow.

Layered payloads and runtime behavior

Kaspersky’s analysis details several nested payload stages:

• XAML-1: a loader whose job is to initialize an embedded payload, XAML-2.
• XAML-2: starts the second stage and loads two compressed, Base64-encoded XAML files: XAML-2-1 (used to bypass the Antimalware Scan Interface, AMSI) and XAML-2-2.
• XAML-2-2: contains a .NET module (NET 1 Loader) and a JSON payload (JSON-1).
• JSON-1: split into JSON-1-c (C2 configuration) and JSON-1-p (a Base64-encoded .NET 2 Plugin and compressed/encrypted XAML templates used to build XAML-3).
• NET 1 Loader: decrypts, assembles, and loads XAML-3, reports status to the C2 server, and removes extracted malicious files as well as CLR usage logs and Windows Prefetch cache entries to erase traces.
• XAML-3: runs inside dllhost.exe, decodes and loads the .NET 2 Plugin.
• .NET 2 Plugin: reads the C2 configuration, collects system information from the Registry, confirms it is running in dllhost.exe, then waits a jitter delay (20–40 minutes) before reaching out to its command-and-control server.

Command-and-control timing and behavior

According to Kaspersky, the .NET 2 Plugin contacts an identified C2 (noted as openaigpt4v[.]com in telemetry) and enters a periodic polling loop. If the C2 responds with valid data, the implant pauses 5–6 minutes between polling cycles; if not, it will wait 22–28 hours and check every 10 minutes whether the interval has elapsed. When instructed, the implant fetches XAML payloads from the C2 and executes them inside isolated AppDomains.

Scope, attribution, and likely target

Kaspersky found telemetry indicating a single victim in Asia. The targeted Windows 10 build was a customized edition intended for government use only. While the investigators did not publicly attribute the campaign to a named threat actor, contextual clues in the report point to a likely focus on state environments; the report notes the existence of a Microsoft offering called Windows 10 China Government Edition used by Chinese government and state-owned entities, making China a plausible target though not confirmed.

Broader context and takeaways

Kaspersky described the operation as indicative of supply chain or trusted-vendor compromise and highlighted the complexity of the multi-layered .NET/XAML/JSON payloads and the use of AppDomainManager injection to execute within legitimate processes. The company observed that nation-states and government organizations increasingly face distinct risks when relying on bespoke or third-party platform builds, and quoted the tradeoff between national control over core software and the burden of securing a uniquely maintained ecosystem. Earlier reporting from Bloomberg referenced Chinese authorities encouraging some agencies to migrate away from Microsoft’s Government Edition toward domestic Linux distributions, a policy move framed around data-security concerns.

Conclusion

NetamLoader’s chain demonstrates how adversaries can combine legitimate utilities and nuanced .NET mechanisms like AppDomainManager to deliver stealthy, multi-stage implants tailored for high-value targets. Kaspersky’s findings underscore the persistent risks to bespoke government platforms and the challenges in detecting deeply nested, in-memory assembly-loading frameworks that aim to bypass standard defenses.