Cybersecurity experts have unveiled a complex cyber attack aimed at governmental bodies in Asia, focusing on a specialized Windows 10 version used by these entities. The attack centers around a previously unidentified .NET assembly-loading framework known as NetamLoader.
Unveiling the Attack
Disclosed by Kaspersky, the attack involves a sophisticated infection chain that has not yet been linked to any specific threat actor. Detected in early 2026, the malware was found in a Windows cabinet file within the directory designated for Windows OS updates. This points to a potential supply chain attack, indicating that attackers may have breached a trusted vendor to infiltrate systems downstream.
The malicious framework utilizes a technique called AppDomainManager injection. This method allows the loading of arbitrary .NET assemblies by exploiting the AppDomainManager mechanism during application start-up, akin to DLL sideloading, to execute harmful code under the guise of legitimate processes.
Details of the Infection Chain
The infection process begins with the execution of “PatchMyPC-ScriptRunner.exe,” which acts as a trigger for further payloads. This initiates the loading of “Microsoft.HostIntegration.Connectors.dll,” which in turn leverages “fabric.config” to execute “Resources.resx.” This latter file is packed with layers of encoded, compressed, and encrypted payloads, including XAML files and .NET assemblies.
As the attack progresses, these components decode and load additional payloads, ultimately leading to the execution of .NET assemblies that interact with command-and-control servers. This sophisticated process disguises the malware’s activities within legitimate application processes, making detection challenging.
Implications and Future Prospects
Kaspersky’s findings highlight the attack’s specificity, targeting a Windows 10 build used by a government in Asia, likely China, where Microsoft offers a bespoke version of its operating system. The attack aligns with geopolitical trends where countries develop their own software ecosystems to reduce reliance on foreign technology.
Bloomberg reported in August 2026 that Chinese government agencies were instructed to switch from Windows 10 Government Edition to domestic Linux distributions, driven by data security concerns. This shift reflects a broader global movement toward indigenous software platforms, albeit with significant challenges in securing and maintaining these systems.
As nations seek greater autonomy over their software infrastructures, the need for robust cybersecurity measures becomes critical. The development and protection of such systems are complex and lengthy, necessitating a delicate balance between innovation and security.
