NetamLoader Targets Asian Government Windows 10 Builds

Cybersecurity researchers at Kaspersky have detailed a highly sophisticated infection chain targeting government organizations in Asia. The activity focused on a custom Windows 10 build used exclusively by government entities in the region. The attack involves the deployment of a previously undocumented .NET assembly-loading framework codenamed NetamLoader. The artifact was detected in the first half of 2026 and packaged inside a Windows cabinet archive placed in a directory that stores operating system update packages. The operation is suspected to involve a supply chain attack where bad actors compromised a trusted third-party vendor.

The sample features a configuration file that employs AppDomainManager injection to load arbitrary .NET assemblies. The archive contains seven files, four of which are legitimate components of Patch My PC. None of the files except Resources.resx embed malicious code. XAML-2-1 is used to bypass Antimalware Scan Interface, while JSON-1 contains a command-and-control server configuration component. The .NET 2 Plugin waits a random jitter delay of 20-40 minutes before issuing its first request to the C2 server openaigpt4v[.]com.

Telemetry data gathered by Kaspersky has identified a single victim in Asia. Signs suggest the targeted Asian country is likely China due to Microsoft offering a bespoke Windows 10 China Government Edition. Earlier this August, Bloomberg reported that China's Ministry of State Security ordered some government agencies to stop using the Government Edition in favor of Chinese-made Linux distributions. Beijing's instruction stemmed from data security concerns. The attack has not been attributed to any known threat actor or group. It is unclear if the intrusion compromised more than one system or allowed hackers to steal sensitive information.