NetamLoader Malware Targets Asian Government Windows 10 Systems Through Advanced .NET Injection Technique

Cybersecurity researchers have uncovered a sophisticated malware campaign targeting government organisations in Asia, using a previously undocumented .NET-based framework to infiltrate specially customised Windows 10 systems.

The malware, identified as NetamLoader, was discovered by Russian cybersecurity firm Kaspersky, which described the attack as a highly sophisticated infection chain involving multiple stages of malicious code execution.

According to Kaspersky, the operation specifically targeted a customised version of Windows 10 reportedly reserved for government organisations in Asia.

The researchers disclosed that the malware was detected during the first half of 2026 and was concealed inside a Windows Cabinet (CAB) archive placed within a directory used for storing operating system update packages.

The attackers reportedly exploited a technique known as AppDomainManager injection to execute malicious .NET assemblies through legitimate application processes, making the infection more difficult for conventional security tools to detect.

The attack has not been attributed to any known hacking group, and investigators have not established whether multiple systems were compromised or whether sensitive government information was successfully stolen.

Kaspersky said the discovery raised concerns about a possible supply chain attack, in which cybercriminals compromise a trusted software provider or third-party service to gain access to organisations relying on its products.

The malicious archive contained seven files, including several legitimate components associated with Patch My PC, an endpoint management software platform.

The files included fabric.config, Microsoft.HostIntegration.Connectors.dll, PatchMyPC-Enum.dll, PatchMyPC-Models.dll, PatchMyPC-ScriptRunner.exe, PatchMyPC-ScriptRunner.exe.config and Resources.resx.

Although most of the files were legitimate software components, the attackers manipulated the application configuration process to introduce malicious code into the system.

According to the investigation, the infection unfolds in two major stages.

During the first stage, PatchMyPC-ScriptRunner.exe is executed and abused to initiate AppDomainManager injection. This allows the attackers to manipulate the .NET Framework application-loading process and execute Microsoft.HostIntegration.Connectors.dll.

The malicious component subsequently searches for a configuration file called fabric.config, which directs it to load Resources.resx.

Kaspersky discovered that Resources.resx contains several layers of encoded, compressed and encrypted payloads, including XAML files, .NET assemblies and JSON data.

These components work together to activate the subsequent stages of the malware infection.

The second stage involves several interconnected payloads designed to bypass security monitoring, decrypt malicious files and establish communication with the attackers’ command-and-control infrastructure.

Among the components identified were XAML-1, XAML-2, XAML-2-1 and XAML-2-2, alongside additional .NET and JSON payloads.

One of the components, XAML-2-1, is specifically designed to bypass Microsoft’s Antimalware Scan Interface (AMSI), a security technology used by Windows to help detect malicious scripts and suspicious code execution.

Another component, identified as XAML-2-2, contains a .NET module known as .NET 1 Loader and a JSON payload responsible for storing additional configuration information.

The JSON data contains command-and-control server details, an encoded .NET plugin and encrypted XAML templates used to construct another malicious payload known as XAML-3.

Kaspersky explained that the .NET 1 Loader performs several functions, including decrypting, assembling and loading the malicious components.

It also communicates the infection status to the attackers’ command-and-control server and attempts to erase evidence of the intrusion.

As part of its concealment activities, the malware deletes malicious files extracted from the original CAB archive, alongside certain Common Language Runtime (CLR) usage logs and Windows Prefetch cache files that could help investigators reconstruct the attack.

The next component, XAML-3, operates within the legitimate Windows process dllhost.exe and is responsible for decoding, decompressing and loading another malicious component known as .NET 2 Plugin.

Once activated, the plugin collects information about the infected computer through the Windows Registry and checks whether it is running inside the expected dllhost.exe process.

It then introduces a random delay of between 20 and 40 minutes before making its first connection to the attackers’ command-and-control server, identified as openaigpt4v[.]com.

The malware subsequently enters a continuous communication cycle, periodically requesting additional XAML files from the server and executing them within isolated application domains.

Kaspersky said that when the malware receives a valid response from its command-and-control infrastructure, it pauses for approximately five to six minutes before making another request.

However, when no valid response is received, the malware can wait between 22 and 28 hours, checking at 10-minute intervals to determine when to resume communication.

The researchers said their telemetry had identified one victim in Asia, with the malware specifically designed to target a customised government version of Windows 10.

Although Kaspersky did not identify the country involved, the investigation suggested that China could be a possible target because Microsoft previously developed a special operating system known as Windows 10 China Government Edition for Chinese government institutions and state-owned organisations.

The discovery comes amid growing concerns over China’s dependence on foreign technology.

In August 2026, Bloomberg reported that China’s Ministry of State Security had directed some government agencies to discontinue the use of Windows 10 Government Edition in favour of locally developed Linux-based operating systems.

The reported directive was linked to concerns about data security and the country’s efforts to reduce reliance on foreign technology providers.

Kaspersky noted that governments across the world were increasingly developing independent technology infrastructure, including operating systems, databases, middleware and cloud platforms.

However, the cybersecurity firm warned that developing domestic technology ecosystems also creates new security responsibilities, as governments must independently protect and maintain increasingly complex digital infrastructures.

The discovery of NetamLoader highlights the growing sophistication of cyber espionage operations targeting government networks, particularly attacks that exploit legitimate software components and trusted system processes to remain undetected.

It also underscores the importance of supply chain security, continuous monitoring and advanced threat detection as cybercriminals increasingly develop multi-stage malware capable of bypassing conventional security protections.