Kaspersky details NetamLoader attack on Asian government systems

Cybersecurity researchers have disclosed a highly sophisticated infection chain targeting government Windows 10 systems in Asia, described by Kaspersky as involving a custom government-edition build and a previously undocumented .NET assembly-loading framework codenamed NetamLoader.

The activity, detected in the first half of 2026, appears to have been delivered via a CAB archive placed in a directory that stores Windows update packages, with the archive’s contents eventually extracted to a PatchMyPC-related directory. The operation is not attributed to a known actor, and it remains unclear whether multiple machines were compromised or if sensitive data was exfiltrated.

The infection chain starts with PatchMyPC-ScriptRunner.exe, which abuses AppDomainManager injection to parse PatchMyPC-ScriptRunner.exe.config and load Microsoft.HostIntegration.Connectors.dll. That DLL then reads fabric.config in the same folder to load Resources[.]resx, which contains multiple encoded, compressed, or encrypted payloads (including XAML files, .NET assemblies and JSON data).

The payload progression includes XAML-1 (a loader for XAML-2), XAML-2-2 (loading a .NET 1 Loader and JSON-1), and JSON-1’s components (JSON-1-c with C2 config and JSON-1-p containing a Base64-encoded .NET 2 Plugin and XAML templates for XAML-3). XAML-3 runs inside dllhost.exe to execute the .NET 2 Plugin, which then communicates with a C2 server (openaigpt4v[.]com) and cycles through a staged, timed polling mechanism.

Kaspersky notes a single Asian victim with a Windows 10 Government Edition, and Bloomberg has reported China’s use of a state-edition OS in government agencies. The researchers caution that attribution to a specific actor remains unconfirmed.