NetamLoader: XAML-based .NET loader hits Asian government Windows 10 build in suspected supply-chain attack

Linha do tempo

1. gbhackers.com ↗ · pub. 30/10/2026 12:02 · coletado 30/10 14:00

   NetamLoader, a XAML-based .NET loader, hits Asian government networks via a trojanized Windows update channel

   ler a análise desta fonte ocultar

   Kaspersky researchers identified NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. Kaspersky saw one victim in Asia and infers a wider government focus. Telemetry flagged a malicious .config file inside a CAB archive in C:\Windows\SoftwareDistribution\Download. The rest of the CAB held legitimate Patch My PC components, and the injected assemblies were Microsoft-signed.

   Technical Details

   • Initial execution: PatchMyPC-ScriptRunner.exe loads a crafted config file that uses AppDomainManager injection. The config points to Microsoft.HostIntegration.Connectors. Its DataCacheFactoryConfiguration class reads fabric.config, which parses the malicious Resources.resx.
   • Resources.resx holds a Base64 BinaryFormatter object that triggers a TypeConfuseDelegate deserialization attack and calls XamlReader.Parse() to run XAML-1.
   • XAML-1 derives an AES key from the SHA-256 hash of the host's command line and decrypts XAML-2. If decryption fails, the process exits silently.
   • XAML-2 unpacks XAML-2-1, which hijacks AMSI by redirecting the CAmsiAntimalware::Scan pointer to a patched Console.Clear() so every scan returns clean. It also unpacks XAML-2-2, which delivers the .NET 1 Loader and its JSON C2 configuration.
   • The loader erases update records, CLR usage logs and Prefetch files. It strips GetExtendedUpdateInfoHandler entries from CmitUpdateAgent logs, which may point to the custom government Windows build.
   • It uses an RPC-created COM object to launch XAML-3 inside dllhost.exe, detaching the payload from the original process tree to evade EDR.
   • The final plugin waits 20–40 minutes before first contact to defeat sandboxes. It polls its C2 every 5–6 minutes, or every 22–28 hours after a failure.
   • C2 traffic uses AES-128-CBC with HMAC-SHA256, and the plugin accepts any certificate. Downloaded XAML runs in an isolated AppDomain. A watchdog terminates the process after about 28 hours.
   • C2: openaigpt4v[.]com, behind Cloudflare at 104.18.14[.]219.

   Remediation

   • Watch for unexpected .config files beside .NET executables, especially in SoftwareDistribution\Download\Install.
   • Alert on AMSI tampering and on dllhost.exe launched through COM.
2. securelist.com ↗ · pub. 29/10/2026 05:00 · coletado 29/10 06:00 primeiro registro

   Unknown APT deploys NetamLoader XAML framework against custom Windows 10 build used by Asian governments

   ler a análise desta fonte ocultar

   Kaspersky GReAT reports NetamLoader, a previously unknown, multi-stage .NET loading framework built on XAML. It was found after a KSN alert in the first half of 2026 and strongly indicates a supply-chain attack on a custom Windows 10 build used exclusively by government entities in Asia. The malicious CAB archive sat in the Windows update download folder and carried legitimate Patch My PC components and Microsoft-signed assemblies. No attribution to a known APT group has been established.

   Technical Details

   • Delivery: a CAB archive (e4537a1762fcafd2fd96bfc825bad34f9db9a24d) holds seven files extracted to C:\Windows\SoftwareDistribution\Download\Install\. Execution of PatchMyPC-ScriptRunner.exe uses AppDomainManager injection via PatchMyPC-ScriptRunner.exe.config. The config loads the Microsoft-signed DataCacheFactoryConfiguration class, which reads a crafted fabric.config. That in turn instantiates ResXResourceSet to parse Resources.resx.
   • Stage 1: Resources.resx contains a Base64 BinaryFormatter object that triggers a TypeConfuseDelegate deserialization chain. The chain calls XamlReader.Parse() to load XAML-1, which derives an AES key from the SHA-256 of the lowercased host command line and decrypts XAML-2. On any failure it calls Environment.Exit(0).
   • Stage 2: XAML-2-1 patches AMSI by redirecting the CAmsiAntimalware::Scan vtable pointer to a patched Console.Clear(), so every scan returns clean. XAML-2-2 holds the .NET 1 Loader and its JSON C2 configuration.
   • Anti-forensics: the loader deletes the malicious files, update records, CLR usage logs and Prefetch entries. It also strips lines containing GetExtendedUpdateInfoHandler from %WINDIR%\Logs\CmitUpdateAgent logs. The CmitUpdateAgent keyword may link to the custom Windows 10 build.
   • Registry state tracking: a GUID-based exception-state log under HKLM\SOFTWARE\Classes\appid is derived from the C2 URL.
   • Execution outside the process tree: it requires administrator rights and sets COMPlus_ETWEnabled=0. It then abuses a remote COM object over RPC (CLSID ab8902b4-09ca-4bb6-b78d-a8f59079a8d5) with the same deserialization technique to load XAML-3 into dllhost.exe. This separates the payload from the initial process and evades EDR behavioral monitoring.
   • .NET 2 Plugin: runs inside dllhost.exe, collects .NET and BuildLab registry values, and locks the process with CoLockObjectExternal. It waits a 20-40 minute jitter delay before first contact, has a ~28-hour (100801 s) watchdog that triggers exit, and polls the C2 at https://openaigpt4v.com/model_v4/<instance GUID> with AES-encrypted traffic.
   • Detections: Kaspersky detects the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*.

   Remediation

   • Hunt for PatchMyPC-ScriptRunner.exe with an accompanying .config, fabric.config or Resources.resx in SoftwareDistribution\Download\Install.
   • Look for dllhost.exe instances spawned via RPC with .NET CLR loaded.
   • Look for anomalous appid registry key creation or deletion and the DllSurrogate value.
   • Monitor for outbound traffic to openaigpt4v.com.
   • Audit update-channel integrity for the custom Windows 10 build.