Threat intel

Kaspersky's Global Research and Analysis Team (GReAT) has published an analysis of NetamLoader, a previously unknown .NET malware framework found on a customised Windows 10 build that only government bodies in one Asian country use. Kaspersky did not name the country, saw one victim in its telemetry and could not link the attack to any known threat group. The report went out on Securelist on October 29, 2026.

Very little of it is malware. The loader arrived as a cabinet (CAB) archive in the Windows update download folder holding seven files, and only one, a resource file, contained malicious code. The rest were parts of the Patch My PC patching tool, Microsoft-signed .NET assemblies and two configuration files edited to point at the payload. Any organisation that runs its own Windows image, third-party patch tooling or allowlisting that trusts signed binaries should read this as a test of its own detection.

How the loader starts

Kaspersky first flagged the sample in the first half of 2026, when its telemetry alerted on a .config file using AppDomainManager injection. AppDomainManager is a .NET feature that lets an application's configuration file name a class to load when the program starts. Attackers abuse it by shipping a trusted executable with an edited .config beside it, so the trusted program loads their code. MITRE tracks this as T1574.014, a cousin of classic DLL side-loading.

The CAB sat at C:\Windows\SoftwareDistribution\Download\, named by its hash, and was extracted into an Install subfolder. Kaspersky saw PatchMyPC-ScriptRunner.exe launched with an -updatepackage argument. Its edited PatchMyPC-ScriptRunner.exe.config points at a class in the Microsoft-signed Microsoft.HostIntegration.Connectors assembly, which reads a second file, fabric.config. That file tells .NET to parse Resources.resx, which holds a serialized object. Deserializing it runs XAML, a markup language .NET can turn directly into live objects and method calls.

From there the layers unwrap one inside another. The first XAML stage derives an AES key from a SHA-256 hash of the host process's command line, so the payload only decrypts when launched exactly as intended, and exits silently otherwise. The next stage patches the Antimalware Scan Interface (AMSI), the hook that lets Defender and other products inspect scripts and .NET content in memory, so every scan reports clean. It does this by redirecting the Scan pointer in AMSI's function table to a patched method, and only on 64-bit hosts.

What it does once running

The first .NET loader cleans up after itself. It deletes the three extracted files, the CLR usage log at %LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\PatchMyPC-ScriptRunner.exe.log and the Prefetch entries for the script runner. It also filters selected lines out of logs under %WINDIR%\Logs\CmitUpdateAgent\, an update agent Kaspersky ties to the custom government build. It needs administrator rights, sets COMPlus_ETWEnabled to 0 so the .NET runtime stops reporting to Event Tracing for Windows (ETW),.

It then moves itself out of the Patch My PC process. Using a remote COM object and the same deserialization trick, it loads the next stage into dllhost.exe, the standard Windows COM surrogate. Kaspersky's view is that this breaks the link between the original process and the later activity, which is what many endpoint detection and response (EDR) rules key on. The plugin registers an AppID key with an empty DllSurrogate value and keeps the surrogate alive.

The plugin talks to openaigpt4v[.]com over HTTPS behind Cloudflare, on the path /model_v4/ followed by an instance ID. Payloads are encrypted with AES-128-CBC and authenticated with HMAC-SHA256, then Base64-encoded. The server sends back XAML, which runs in a fresh, isolated AppDomain, so the operators can push any code they like without new files on disk. Kaspersky did not describe a fixed command set. The domain has no known link to OpenAI.

The timing is built to slip past short investigations. The configuration waits 20 to 40 minutes before the first connection. If the server does not reply, it sleeps 22 to 28 hours before trying again, and a watchdog ends the process after about 28 hours. After a valid reply it polls every five to six minutes.

The supply chain question

Kaspersky says the location and contents of the archive point to a supply chain attack, but it did not see how the CAB reached the machine. It found no sign that Patch My PC or its distribution was compromised. The safer reading is that the attackers had a way to drop files into the update cache, whether through an internal update server, a management channel or an earlier foothold, and chose a tool the target already trusted.

What to do

The steps below apply to any Windows estate.

1. Sweep for the published indicators. Look for PatchMyPC-ScriptRunner.exe.config, fabric.config or Resources.resx in C:\Windows\SoftwareDistribution\Download\Install\, DNS or proxy hits for openaigpt4v[.]com, and the MD5 hashes for each stage listed at the end of Kaspersky's report. Kaspersky products detect the loader as HEUR:Trojan.MSIL.NetamLoader.gen. Do not block on the Cloudflare IP alone; it is shared with unrelated sites.
2. Treat executables in the update cache as suspicious. Legitimate Windows Update content in SoftwareDistribution\Download is not normally run from there. Alert on any process image or .config file created under that path, and on PatchMyPC-ScriptRunner.exe starting from anywhere other than your Patch My PC install location.
3. Hunt for AppDomainManager abuse. Search for .config files containing appDomainManagerAssembly or appDomainManagerType next to signed executables outside Program Files, and for processes that set COMPlus_ETWEnabled=0. Sysmon event ID 11 (file create) and 1 (process create) cover both.
4. Watch dllhost.exe. A COM surrogate that loads System.Xaml or PresentationFramework, or makes outbound HTTPS connections to a domain you have never seen, deserves a look. So do new HKLM\SOFTWARE\Classes\AppID\{GUID} keys with an empty DllSurrogate value.
5. Tighten allowlisting. Microsoft's Windows Defender Application Control (WDAC) and AppLocker rules that trust anything signed by Microsoft will allow this chain. Restrict where trusted binaries may run from, and block executables in writable system folders like the update cache.
6. Look for missing evidence. Gaps in Prefetch for a binary you know ran, a missing CLR usage log, or edited update agent logs are signs of cleanup. Forward Sysmon and update logs to a central store so local deletion does not erase them.

If you find a hit, isolate the host, image memory before rebooting (the payloads live mostly in memory), and assume the operators had administrator rights. Rotate local admin and service credentials used on that machine and check your update distribution servers for the same CAB.

The wider lesson

Organisations that build their own operating system image gain control but inherit the job of securing every update path into it. The NetamLoader operators did not need a zero-day. They needed write access to one folder and a signed program that would follow a config file. Every file that ran was signed or legitimate, so detection has to look at where a program runs from and what it loads, for example a patch tool starting from the update cache.

Our security operations team builds hunts like these for AppDomainManager and side-loading abuse, and our safeguarding and hardening work reviews allowlisting and update channels. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.

---

Sources: Kaspersky Securelist, Newsbytes.PH, SecurityLab.ru, GBHackers, NetManageIT.