Kaspersky uncovers NetamLoader supply chain attack on Asian government

Kaspersky has detailed a suspected supply-chain incident in mid‑2026, centred on a malicious CAB archive found in a Windows update download folder. Although the package appeared to be part of the Patch My PC patch management tool and carried Microsoft-signed .NET components, investigators say the CAB concealed a multi-stage infection chain that culminates in NetamLoader, a new .NET loader built on XAML markup.

The company notes a single Asia‑based government client as the observed victim, and emphasises that Patch My PC itself was not proven breached; rather, legitimate files were bundled with malicious config and resource files. Kaspersky describes the overall verdict as “strongly indicates a supply-chain attack”.

The attackers allegedly began with AppDomainManager injection to load a chosen .NET assembly before the host program’s main code runs, using a Microsoft‑signed caching library with a design flaw to load a resource containing hidden payloads. This triggered an unsafe .NET deserialization step, executing XAML code that could extract a decryption key from the host process’s command line.

A second stage then patched AMSI to report scans as clean, before a first .NET loader erased traces, disabled .NET event tracing, and used a remote COM object to load further payloads inside a new dllhost.exe process to evade behavioural monitoring. NetamLoader then gathers system details, waits 20–40 minutes, and periodically contacts its server every 22–28 hours, with all traffic protected by AES-128-CBC and HMAC. The server returns new XAML code executed in isolated AppDomains.

Kaspersky labels the threat as HEUR:Trojan.MSIL.NetamLoader[.]gen, with attribution undetermined. The researchers warn the target ecosystem—government‑specific Windows builds—remains at risk as more nations pursue bespoke operating systems.