"In today's geopolitical climate, a growing number of countries are building their own core software platforms, including operating systems, databases, middleware, and cloud services, with operating systems often the top priority," Kaspersky concluded.
NetamLoader: a previously undocumented .NET assembly-loading framework
Security researchers at Kaspersky disclosed a sophisticated infection chain observed in the first half of 2026 that uses a previously undocumented .NET assembly-loading framework codenamed NetamLoader. The artifact was detected inside a Windows cabinet (CAB) archive placed in a folder used for operating system update packages. The campaign targets a custom Windows 10 build used exclusively by government organizations in Asia and relies on AppDomainManager injection — an adversarial technique that hijacks the .NET Framework's AppDomainManager at application start to load arbitrary assemblies. Kaspersky notes the end result is functionally equivalent to DLL sideloading: execute malicious code inside a legitimate process to evade detection.
The two-stage infection chain and payload architecture
Kaspersky describes NetamLoader's execution as a two-stage process that begins with a legitimate-sounding launcher and finishes with a multi-layered XAML/.NET payload that phones home. The CAB archive held seven files; the launcher is PatchMyPC-ScriptRunner.exe and its associated .config file is abused via AppDomainManager injection to parse and execute Microsoft.HostIntegration.Connectors.dll. That DLL reads fabric.config, which leads to loading Resources.resx — the only file in the archive Kaspersky identified as embedding malicious content.
Resources.resx contains “multiple layers” of encoded, compressed, or encrypted payloads. Kaspersky details a chain of XAML and .NET components:
- XAML-1: a loader for an embedded payload (XAML-2).
- XAML-2: initializes a second stage that loads compressed, Base64-encoded XAML-2-1 and XAML-2-2; XAML-2-1 is used to bypass the Antimalware Scan Interface (AMSI).
- XAML-2-2: contains a .NET module (.NET 1 Loader) and a JSON payload (JSON-1). JSON-1 contains command-and-control configuration and a Base64-encoded .NET 2 Plugin plus compressed, encrypted XAML templates used to build XAML-3.
- .NET 1 Loader: decrypts, assembles and loads XAML-3, reports status to the C2, and deletes malicious files extracted from the CAB along with CLR usage logs and Windows Prefetch cache files.
- XAML-3: runs inside dllhost.exe to decode, decompress and load .NET 2 Plugin.
- .NET 2 Plugin: loads C2 configuration, collects registry-based system information, verifies it runs in dllhost.exe, waits a random 20–40 minute jitter before its first C2 request to openaigpt4v[.]com, then enters a periodic polling loop to fetch XAML payloads and execute them in isolated AppDomains.
Kaspersky reports the C2 polling logic: if a valid response is received, the loop pauses 5–6 minutes before the next request; otherwise the implant pauses 22–28 hours, checking every 10 minutes to determine whether that allotted time has elapsed.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSupply chain indicators and Patch My PC artifacts
The CAB was placed at C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24, with its contents extracted and dropped into C:\Windows\SoftwareDistribution\Download\Install\. Present in the archive alongside the malicious Resources.resx were four legitimate components of Patch My PC endpoint-management software: fabric.config, Microsoft.HostIntegration.Connectors.dll, PatchMyPC-Enum.dll, and PatchMyPC-Models.dll, plus PatchMyPC-ScriptRunner.exe and its .config. Kaspersky says the exact delivery vehicle remains unknown but suspects a supply chain attack in which a trusted third-party vendor was compromised to reach downstream government users.
Telemetry, target, and regional context
Kaspersky's telemetry identified a single victim in Asia. The malware appears tailored to a Windows 10 build customized for government-only use; the targeted Asian country was not disclosed. Kaspersky notes signs point to China because Microsoft offers a bespoke version called Windows 10 China Government Edition specifically for the Chinese government and state-owned entities. The report also cites a Bloomberg account from August that China's Ministry of State Security had ordered some government agencies to stop using the "Government Edition" in favor of Chinese-made Linux distributions, a move Bloomberg attributed to data security concerns.
What this means for technologists, procurement leaders, and affected government IT teams
- Technologists and security teams: Expect a complex, multi-stage .NET/XAML toolset that uses AppDomainManager injection and AMSI bypasses; look for footprints in SoftwareDistribution paths, dllhost.exe process injection, and post-execution cleanup of CLR and Prefetch artefacts.
- Procurement and policy leaders: The incident underscores Kaspersky's point about countries building bespoke operating system stacks — and the attendant risk when trusted third-party vendors are part of government update or endpoint-management workflows.
- Affected government IT teams: The implant's long jitter and conditional polling behavior, plus deliberate removal of extracted files and logs, complicate detection; examine SoftwareDistribution directories and any unexpected CABs or extracted installers used by endpoint-management tools.
Key facts remain unresolved: the attack has not been attributed to any known threat actor, and Kaspersky says it is not clear if more than one system was compromised or whether any sensitive information was exfiltrated. The presence of a bespoke loader, deep .NET/XAML layering, targeted Windows 10 build, and a C2 domain of openaigpt4v[.]com together signal an operation designed for stealth and persistence — and they leave open the central question Kaspersky flags: how many systems and what data, if any, were affected.
