APT Groups Deploy NetamLoader to Target Windows 10 Systems in Asian Government Networks

A newly observed malware framework named NetamLoader is being deployed against a customized build of Windows 10 used only by certain government agencies in Asia. The operation appears to be a supply-chain style campaign, and researchers have not yet attributed it to any known threat actor.

NetamLoader is concealed inside a Windows update package, leverages trusted signed components to execute, and removes traces of its activity.

The malware also uses very slow, delayed communication patterns with its operators so brief sandbox checks can overlook it. Even a file that appears legitimate and is signed by a known vendor can be part of the infection chain.

Researchers from Securelist, the Kaspersky GReAT blog, discovered the framework and published a detailed technical analysis on October 29, 2026.

Kaspersky’s telemetry first flagged the threat in the first half of 2026 after detecting a suspicious .config file stored inside a CAB archive within the Windows update package folder.

APT Hackers Use NetamLoader Malware

Initially the archive appeared benign. Most files were legitimate components from Patch My PC, a third-party patching tool, and the .NET modules referenced in the chain carried Microsoft signatures.

Only a single file, Resources.resx, actually contained malicious code. Analysts did not observe how the archive was delivered to the victim and found no evidence that Patch My PC itself had been compromised.

The infection begins when PatchMyPC-ScriptRunner.exe runs. Its configuration file abuses AppDomainManager injection to load code before the program’s normal entry point executes.

That configuration points to a Microsoft-signed module which loads a second file named fabric.config. That file causes Windows to open Resources.resx, and an issue in the legacy BinaryFormatter mechanism triggers execution of the first concealed XAML script.

After that, multiple layers of payloads are unpacked sequentially. Each layer is encoded, compressed, or encrypted, and the initial decryption key is taken from the running program’s command line.

If the command line value is incorrect, as commonly happens in sandbox environments, decryption fails and the program exits quietly. In the second stage the malware disables protections: a large XAML payload patches the Windows Antimalware Scan Interface (AMSI) so that subsequent scans report “clean.”

Strings and other sensitive text are split into many small fragments to evade signature-based detection. This technique is similar to other campaigns that abused signed utilities to bypass defenses.

The initial loader then performs cleanup. It deletes extracted files, .NET usage logs, and Prefetch entries, and removes lines from update logs located in a directory named CmitUpdateAgent, which Kaspersky notes may be associated with the government-specific Windows build.

Finally, the loader uses a remote COM object to launch the last-stage payload inside dllhost.exe, isolating it from the original process and helping it evade EDR behavioral checks.

Slow Command Channel Keeps the Malware Hidden

The final component, identified as the .NET 2 Plugin, communicates with a command-and-control (C2) domain registered as openaigpt4v[.]com.

Although the domain name resembles an AI service, it is fronted by Cloudflare. The malware delays its first callback by 20 to 40 minutes to increase the chance of outliving automated sandbox tests.

After receiving a valid response, the implant checks in every five to six minutes. If no reply is received, it switches to a backoff mode where it waits 22 to 28 hours and then polls every ten minutes to see if that period has expired.

A timer also forces the process to terminate after roughly 28 hours. All communications are encrypted with AES and validated with an HMAC. The malware probes for a proxy using three different methods so it can operate in restrictive network environments.

Downloaded XAML modules are executed inside a temporary AppDomain that is unloaded afterward. This approach keeps the main process stable and reduces forensic artifacts.

Kaspersky notes a similar AMSI-patching tactic was seen in an earlier GhostContainer backdoor case in Asia, where the backdoor disabled AMSI prior to executing additional functionality.

Kaspersky observed just one victim in its telemetry. Because the framework targets a government-specific Windows build, the researchers conclude the intended victims are likely government organizations in Asia.

The report emphasizes that countries developing their own operating system variants must secure the entire software supply chain themselves—a process that requires time and investment.

Kaspersky detects this threat under signatures such as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast, and Trojan.Script.Agent. Defenders are advised to monitor update directories for unexpected configuration files and to scrutinize signed executables that load external code unusually.

Additional indicators include unexpected Windows processes with external connections and missing or altered local logs. Forwarding logs to a central server can preserve evidence if local files are erased.

Indicators of compromise (IoCs):

Note: IP addresses and domains have been intentionally defanged (for example, using [.]) to prevent accidental resolution or linking. Re-fang these indicators only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.