An unidentified hacking group slipped a highly evasive malware loader onto machines running a customised Windows 10 build that, according to Kaspersky, is used exclusively by government entities in Asia. The infection chain hid inside the folder Windows uses for its own update downloads, was built almost entirely out of legitimate, Microsoft-signed components, and then scrubbed the logs that would have revealed it.
Kaspersky's Global Research and Analysis Team (GReAT) named the framework NetamLoader in the original report. The researchers say the evidence strongly indicates a supply-chain attack on that government Windows build, but they have not attributed it to any known APT group.
A CAB file that looked clean
The case began in the first half of 2026 with a detection on a .config file abusing AppDomainManager injection, a .NET feature that lets a configuration file load an extra assembly before a program starts. The file sat in a CAB archive in C:\Windows\SoftwareDistribution\Download. A first look found nothing malicious: most executables were legitimate components of the third-party patch management tool Patch My PC, and the .NET assemblies involved were signed by Microsoft. Kaspersky did not observe how the CAB reached the victim, only that PatchMyPC-ScriptRunner.exe ran with update-package arguments.
A re-examination exposed the chain. The configuration loads a signed Windows Server AppFabric caching class, which reads a crafted fabric.config, which in turn parses a Resources.resx file. That file holds a serialized object fed to .NET's BinaryFormatter, which Kaspersky calls well known and highly vulnerable, triggering a deserialization attack that executes layered XAML payloads.
Keyed to one machine, then gone
Several touches make the chain hard to analyse. The first XAML layer derives its AES decryption key from the host process's exact command line, and silently exits on any error. A later layer patches the Windows Antimalware Scan Interface (AMSI) so every scan returns clean, in a way that leaves code integrity checks intact. The loader then deletes the dropped files, CLR usage logs and Prefetch entries, strips lines from update-agent logs under a path containing CmitUpdateAgent, which Kaspersky links to the custom government build, and stops the .NET runtime from registering its event tracing provider. Finally it abuses a remote COM object to load its next stage inside dllhost.exe, separating the infection from its original process tree to evade EDR.
The final .NET plugin is patient. It waits 20 to 40 minutes before first contacting its server, falls back to polling every 22 to 28 hours when the server does not answer, and is configured to accept any TLS certificate. Its command server, openaigpt4v[.]com, borrows OpenAI branding to blend in.
Check update folders for rogue .config files
Kaspersky detects the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*. Defenders running government or other locked-down Windows builds should look for .exe.config files in SoftwareDistribution folders that set appDomainManagerType, for PatchMyPC-ScriptRunner.exe launched from that location without a matching deployment, for unexpected fabric.config or .resx files beside it, and for dllhost.exe making outbound HTTPS connections. Kaspersky describes the Patch My PC files in the archive as legitimate components that the attackers used as a host.
NetamLoader joins the GoSerpent backdoor we covered in July among tools built to spy on governments in the region. What sets it apart is how little of it is actually malicious code.
Indicators of compromise
- C2: hxxps://openaigpt4v[.]com/model_v4/
- CAB archive name: e4537a1762fcafd2fd96bfc825bad34f9db9a24d
- MD5: f2458ed133f8d0ca19e22c10f577e98e
- MD5: e1dc6f1ed193594f2284be22ae08dfa4
- MD5: ab81564bcb8ca7e710c66832de747556
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.