NetamLoader: Sophisticated Malware Quietly Targets Asian Government Windows Builds
Kaspersky has published details of a multi-stage malware framework targeting government organisations in Asia, built around a previously unknown .NET loading mechanism researchers have named NetamLoader. The attack is sophisticated, the target is narrow, and nobody knows who's behind it.
The malware was found in the first half of 2026, tucked inside a Windows Cabinet (CAB) archive sitting in a directory used by Windows to stage OS update packages. That location is not accidental. The working theory is a supply chain compromise, meaning attackers likely got in by subverting a trusted third-party vendor rather than hitting the government target directly.
The CAB file contained seven files, four of which are legitimate components of Patch My PC, an endpoint management tool. Only one file, Resources.resx, actually contains malicious content. The rest serve as cover or scaffolding for the attack chain.
The infection begins when PatchMyPC-ScriptRunner.exe runs. Rather than doing anything overtly malicious itself, it abuses AppDomainManager injection, a technique that hijacks how the .NET Framework initialises application domains, to parse its own config file and kick off a DLL. That DLL then finds fabric.config and uses it to load the payload hiding in Resources.resx.
AppDomainManager injection is functionally similar to DLL sideloading: malicious code runs inside a legitimate process, which makes it harder to spot and easier to wave through security tooling.
What unfolds from there is a nested sequence of XAML files, .NET assemblies, and JSON blobs, each layer decoding and loading the next. One XAML payload disables Windows' Antimalware Scan Interface. Another loads a .NET module that assembles and executes a further XAML stage inside dllhost.exe. After that final payload runs, it erases the extracted CAB contents, clears CLR logs, and wipes Windows Prefetch cache to reduce forensic traces.
The final component, a .NET plugin, collects system information from the Windows Registry, verifies it's running inside dllhost.exe, waits a randomised 20 to 40 minute delay before phoning home, then enters a polling loop. The C2 server is hosted at a domain masquerading as something AI-related: openaigpt4v[.]com. If the server responds, it waits 5 to 6 minutes before the next check. If there's no response, it backs off to a 22 to 28 hour window, checking every 10 minutes to see if the wait is up.
Kaspersky has identified a single confirmed victim. The attack targets a Windows 10 build that exists specifically for government use in Asia. The country wasn't named, but the description fits China, which has its own bespoke version called Windows 10 China Government Edition, distributed to government bodies and state-owned enterprises.
The timing is interesting. Bloomberg reported this August that China's Ministry of State Security has been pushing some agencies to move away from the Government Edition and onto domestically built Linux distributions, citing data security concerns. Whether that directive was triggered partly by incidents like this one isn't known.
No attribution has been made. Kaspersky hasn't linked the activity to any known threat actor, and there's no clarity on whether more than one machine was compromised or whether any data was actually exfiltrated.
What the case does illustrate is that custom OS deployments, however well-intentioned from a sovereignty standpoint, don't automatically mean better security. Running a bespoke platform means owning the entire security surface that comes with it, and that's a substantial undertaking.