NetamLoader Exposes Sophisticated APT Attack on Asian Governments

"Technological sovereignty has become a global trend." That sentence, from the reporting on this intrusion, frames a compact but sophisticated operation that Kaspersky analysts discovered in the first half of 2026: an advanced .NET-based loader, labeled NetamLoader, that appears to target a customized Windows 10 build used exclusively by government entities in Asia.

How NetamLoader got a foothold: a CAB dropped into the Windows update cache

Kaspersky's telemetry began with a malware detection from Kaspersky Security Network (KSN) for a .config file that used AppDomainManager injection to load arbitrary .NET assemblies. The malicious CAB archive (sha1 e4537a1762fcafd2fd96bfc825bad34f9db9a24d) was located at C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24d and extracted into C:\Windows\SoftwareDistribution\Download\Install\. The CAB contained seven files; initially only Resources.resx showed malicious content, while other files (including a Microsoft‑signed assembly referenced in the .config) appeared legitimate. Kaspersky products detect the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*.

Multi-layer XAML loading and a .resx-deserialization chain

The attack chain abuses .NET configuration loading to trigger a deserialization and XAML execution pipeline. PatchMyPC-ScriptRunner.exe was used as the host process; its PatchMyPC-ScriptRunner.exe.config forced loading of the class Microsoft.ApplicationServer.Caching.DataCacheFactoryConfiguration (from Microsoft.HostIntegration.Connectors.dll). When that configuration class read a crafted fabric.config, it caused a ResXResourceSet to parse Resources.resx. The .resx contained a Base64‑encoded BinaryFormatter-serialized object; deserialization enabled a TypeConfuseDelegate exploit that invoked XamlReader.Parse(), loading an initial XAML payload (XAML-1).

XAML-1 derived an AES key from the full command line of the host process (SHA‑256 of the command line), used the first 16 bytes of an embedded blob as an IV, decrypted a second-stage XAML (XAML-2) and suppressed errors by calling Environment.Exit(0) on decryption failure. That pattern—key derivation tied to the host command line and staged XAML decryption—recurs through the framework.

AMSI bypass, process migration to dllhost.exe, and staged plugins

XAML-2 unpacked two ZIP‑compressed XAMLs. XAML-2-1 assembled fragmented strings to create a COM CLSID (fdb00e52-a214-4aa1-8fba-4357bb0072ec), instantiated the AMSI COM object, and patched the AMSI scan routine by replacing the CAmsiAntimalware::Scan pointer with the native pointer of a patched Console.Clear() implementation. The Console.Clear() stub bytes were 41 C7 00 01 00 00 00 33 C0 C3; the AMSI module was modified so every scan returned AMSI_RESULT_CLEAN.

XAML-2-2 delivered a .NET loader (.NET 1 Loader) and a compressed, Base64 JSON configuration (JSON-1). .NET 1 Loader parsed JSON-1 and fetched payloads (including a .NET 2 Plugin and a set of templates used to assemble XAML-3). The loader cleans traces (deleting extracted files, update logs, PreFetch entries and specific log files), resets a registry-based exception-state logging system under LocalMachine\SOFTWARE\Classes\appid\[GUIDs], and then exploited a remote COM object deserialization vulnerability to force execution of XAML-3 inside a separate process (dllhost.exe). This RPC-based transfer separates the malicious workload from the initial process tree and loads the final payloads in a dllhost.exe context.

Command-and-control, encryption, and infrastructure

The final stage loads a .NET 2 Plugin inside dllhost.exe. That plugin gathers system details (for example, .NET version and Windows BuildLab), locks the dllhost.exe surrogate object in memory to prevent termination, waits a long jitter interval (20–40 minutes) and applies a long sleep policy (initial wait and polling delays measured in hours). C2 polling uses an AES‑128‑CBC Encrypt‑then‑HMAC construction derived from a master key (example config item ec = "9fT04e03tAiZAPogcDWt0w==") and rotates HMAC seeds to derive encryption and authentication keys. The configured C2 URL in the sample reported by Kaspersky was https://openaigpt4v[.]com/model_v4/ (full requests append the unique instance id). Kaspersky notes the domain is registered and hosted via Cloudflare; the table in the report lists openaigpt4v[.]com at 104.18.14.219 and “first seen” Sep 27, 2023.

What this means for government OS projects, security teams, and procurement

• Government OS projects and procurement leaders: the malware specifically targeted a custom Windows 10 build described in logs and paths referencing CmitUpdateAgent and a government-only deployment. That custom-update footprint was used as the vector and should be examined closely for supply‑chain and update-channel integrity.
• Security and incident‑response teams: investigators should look for the CAB path C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24d, the extracted Install\Resources.resx, and the registry AppID keys under LocalMachine\SOFTWARE\Classes\appid\ as indicators. The AMSI bypass technique (vtable swap to a patched Console.Clear) and the multi-stage XAML/TypeConfuseDelegate deserialization chain are distinctive TTPs to hunt for.
• Operational defenders and network teams: the C2 domain openaigpt4v[.]com and its Cloudflare‑hosted IP are explicit infrastructure indicators in the report; the malware also uses unusually long polling intervals (days) and long initial delays (about 28 hours), which can complicate detection.

KSN telemetry showed a single victim in Asia; combined with the exploit of a custom update path and the use of signed Microsoft components as part of the loader, Kaspersky's analysis concludes the framework “strongly indicates a supply‑chain attack targeting a custom Windows build used exclusively by government entities in Asia.” The report links an intricate, layered .NET/XAML payload-loading architecture to deliberate measures for stealth—deserialization exploits, AMSI tampering, RPC process migration, and encrypted C2—leaving forensic evidence deliberately pruned from the local system.

Read the original Kaspersky analysis: https://securelist.com/netamloader/121676/