Kaspersky researchers have uncovered a sophisticated cyberattack targeting government organisations in Asia, involving a previously undocumented malware framework called NetamLoader, which exploits .NET's AppDomainManager injection technique to execute malicious code within legitimate processes. The attack, discovered in the first half of 2026, used a multi-stage infection chain delivered via a Windows cabinet (CAB) archive disguised among legitimate Patch My PC software components, ultimately deploying a plugin that communicates with a C2 server and evades detection by clearing logs and disabling antimalware scanning. The campaign is suspected to involve a supply chain compromise and appears to specifically target a customised Windows 10 build used exclusively by government entities, likely China's Government Edition, though no known threat actor has been identified.
