A sophisticated malware framework known as NetamLoader is currently being deployed against a specialized version of Windows 10 utilized exclusively by government entities in Asia. This campaign appears to mimic a supply-chain attack, yet no specific hacking group has been linked to it thus far.
The Stealthy Operations of NetamLoader
NetamLoader employs a deceptive technique by embedding itself within a Windows update package. It utilizes legitimate software to execute its operations and erases its digital footprints to avoid detection. The malware establishes communication with its operators at a slow pace, making short-duration security scans insufficient for its detection. Even files that appear authentic and are signed by recognized vendors can be part of this covert infection.
Experts from Securelist, associated with Kaspersky’s Global Research and Analysis Team (GReAT), have identified this malicious software and released a comprehensive report on October 29, 2026. The initial sighting of the malware by Kaspersky occurred in early 2026, when a suspicious .config file inside a CAB archive within the Windows update package directory was flagged by their threat monitoring network.
How the Infection Chain Unfolds
Initially, the CAB archive containing the malware appeared benign, comprising mostly legitimate components of Patch My PC, a third-party patching tool. Even the .NET files within the chain were signed by Microsoft. However, a singular file, Resources.resx, contained malicious code. Researchers have yet to determine how the archive reaches its intended targets, nor is there evidence of compromise within Patch My PC itself.
The attack sequence begins when PatchMyPC-ScriptRunner.exe is executed. Its configuration file employs AppDomainManager injection to load code prior to the main function’s execution. This configuration directs to a Microsoft-signed module, which then reads a secondary file named fabric.config. This file triggers the opening of Resources.resx, exploiting a vulnerability in the outdated BinaryFormatter feature, which subsequently executes the initial concealed XAML script.
Challenges in Detection and Response
The infection process involves multiple layers, each encoded, compressed, or encrypted, with the primary decryption key derived from the executing program’s command line. If incorrect, as might occur in a sandbox environment, decryption fails, and the program terminates silently. Further stages disable security protections, with a lengthy XAML file altering the Windows Antimalware Scan Interface (AMSI) to ensure scans report “clean” results.
The malware ultimately deletes the extracted files, .NET usage logs, and Prefetch files, while also removing lines from update logs located in the CmitUpdateAgent folder, potentially associated with the customized government Windows build. It subsequently uses a remote COM object to initiate the final payload within dllhost.exe, aiding in evading Endpoint Detection and Response (EDR) systems.
The concluding component, named the .NET 2 Plugin, communicates with a command-and-control (C2) server at openaigpt4v[.]com. Although the domain name suggests an AI service, it is shielded by Cloudflare. The malware waits 20 to 40 minutes before contacting the server, aiding in avoiding sandbox detection. Communication is encrypted using AES with an HMAC check, and the malware searches for a proxy through three methods to ensure functionality within restricted networks.
Implications for Security and Future Vigilance
Kaspersky’s telemetry has identified only a singular victim, leading researchers to deduce that the malware’s targets are governmental bodies within Asia, specifically those utilizing a government-specific Windows build. The report emphasizes the need for countries developing proprietary operating systems to secure the entire software supply chain, a process requiring significant effort and time.
Defensive measures against this threat include monitoring update folders for unexpected configuration files and signed programs that load code in unconventional manners. It is also advised to look for atypical Windows processes with external connections and missing log entries. Centralized logging can preserve evidence in the event of local data wiping by the malware.
