Kaspersky uncovers NetamLoader attack on Asian government target

Kaspersky’s GReAT team describe NetamLoader as a sophisticated, supply-chain style infection chain targeting a government-customised Windows 10 build used by Asian state entities. The campaign was first seen in 2026, after KSN flagged a config file using AppDomainManager injection to load arbitrary .NET assemblies inside a CAB archive stored in the Windows SoftwareDistribution\Download directory.

The CAB’s contents appeared benign at first, consisting mainly of Patch My PC components, but a re‑examination revealed a complex, multi‑layer loading framework that culminates in a .NET/XAML payload chain. Kaspersky detects the threat as HEUR:Trojan.MSIL.NetamLoader[.]gen, Trojan.MSIL[.]Zapchast.* and Trojan.Script[.]Agent.*.

The attack proceeds in two main stages. Stage 1 uses an AppDomainManager injection via PatchMyPC-ScriptRunner.exe.config and a crafted fabric.config to load a ResXResourceSet from Resources[.]resx, which embeds layered payloads (XAML files, .NET assemblies and JSON data) that are decrypted and executed in sequence. XAML-1 then drives Stage 2, where XAML-2 loads two further payloads (XAML-2-1 and XAML-2-2).

XAML-2-1 hijacks AMSI to disable antimalware scanning by patching the AMSI Scan function, while XAML-2-2 delivers a .NET 1 Loader and a JSON-1 payload to orchestrate subsequent stages. The process culminates in XAML-3 and a .NET 2 Plugin loaded into dllhost.exe, which executes a long, jittered, multi‑layered configuration for C2 communication and exfiltration. The C2 is hosted under the domain openaigpt4v[.]com (Cloudflare CDN), with 104.18.14[.]219 as the IP, first seen 27 September 2023.

Victims are identified as a single Asia‑based government target, and attribution remains unassigned to any known APT group. Securelist’s report attributes all claims to the researchers and the Kaspersky Security Network researchers who uncovered the chain.