NetamLoader abuses .NET loading on custom Windows 10
NetamLoader, a previously undocumented malware-loading framework, has been found on a customized Windows 10 system reserved for government use in Asia. Kaspersky detected the artifact during the first half of 2026 and described an elaborate, two-stage chain that runs malicious Microsoft .NET software inside legitimate processes while attempting to conceal its activity.
Kaspersky's telemetry identified one affected system. The researchers did not determine whether additional computers were compromised, whether information was stolen or who conducted the attack. The original delivery method is also unknown. Kaspersky suspects a supply-chain attack, in which an attacker compromises software or services trusted by the eventual target, but the suspected route has not been confirmed and no third-party vendor was identified as the entry point.
The initial artifact was a Windows cabinet archive, or CAB file, placed under `C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24`. Its contents were extracted to `C:\Windows\SoftwareDistribution\Download\Install\`, locations normally associated with operating-system updates. The archive contained seven files: `fabric.config`, `Microsoft.HostIntegration.Connectors.dll`, `PatchMyPC-Enum.dll`, `PatchMyPC-Models.dll`, `PatchMyPC-ScriptRunner.exe`, `PatchMyPC-ScriptRunner.exe.config` and `Resources.resx`. Four were legitimate components associated with the Patch My PC endpoint-management software. Kaspersky found malicious code only inside `Resources.resx`, although the other files helped launch or process it.
Execution began with `PatchMyPC-ScriptRunner.exe`. Its accompanying configuration file used AppDomainManager injection, a technique that changes how a .NET application initializes so an attacker-controlled assembly can run when the legitimate program starts. This loaded `Microsoft.HostIntegration.Connectors.dll`, which read `fabric.config` and then processed `Resources.resx`. The result resembles DLL sideloading, where a legitimate process is induced to run unwanted code, but this chain instead exploited the .NET Framework's application-domain startup mechanism.
The resource file held several layers of encoded, compressed or encrypted content, including XAML files, .NET assemblies and JSON data. XAML-1 loaded an embedded XAML-2 payload. XAML-2 then opened two compressed, Base64-encoded files called XAML-2-1 and XAML-2-2. The first was intended to bypass the Antimalware Scan Interface (AMSI), the Windows interface that lets security software examine certain scripts and other content before execution. The second contained a .NET 1 Loader and a JSON-1 data package.
JSON-1 was divided into a command-and-control configuration, called JSON-1-c, and JSON-1-p, which carried a Base64-encoded .NET 2 Plugin plus encrypted and compressed XAML templates. The .NET 1 Loader decrypted and assembled XAML-3, reported the infection's status to the command-and-control server and removed evidence. Its cleanup covered files extracted from the CAB archive, logs recording Common Language Runtime use and Windows Prefetch cache files.
XAML-3 ran inside the legitimate `dllhost.exe` process and decoded, decompressed and loaded the .NET 2 Plugin. That plugin collected system details from the Windows Registry, verified that it was running inside `dllhost.exe` and read the command-and-control settings. It waited a randomly selected 20 to 40 minutes before contacting `openaigpt4v[.]com`. It then repeatedly requested another XAML payload and could execute a valid response inside an isolated AppDomain, a separated .NET execution area.
Kaspersky found that a successful server response caused the malware to wait another 5 to 6 minutes before contacting the server again. If it received no valid response, it entered a much longer pause of 22 to 28 hours, checking every 10 minutes to see whether that interval had passed. These delays, layered payloads, execution within trusted processes and deletion of local artifacts all make straightforward investigation more difficult, although Kaspersky did not establish what follow-on code the server delivered to the identified victim.
The affected Asian country was not disclosed. Kaspersky assessed that China was a possible location because Microsoft provides Windows 10 China Government Edition for government bodies and state-owned entities, but this was not confirmed. The broader technical issue is that heavily customized operating-system environments require their own mature maintenance and security processes, particularly when updates and management tools form part of the software supply chain.
For IT teams, the most concrete indicators are the named file path, the unusual combination of files, execution through `dllhost.exe` and contact with the reported command-and-control domain. Their presence should be investigated in context because several components in the archive are legitimate and their names alone do not prove an infection. For organizations seeking outside support around this type of operational risk, AEU-I provides security-first IT, infrastructure and consulting.
NetamLoader remains a narrowly observed threat rather than a documented mass campaign. Its operator, initial delivery mechanism, full victim count and impact are still unknown, but the case demonstrates how trusted application components and .NET startup behavior can be combined to hide a multi-layered malware chain on a specialized Windows installation.