NetamLoader .NET framework used in suspected supply chain attack on Asian government Windows 10 build

Linha do tempo

1. thehackernews.com ↗ · pub. 01/11/2026 04:02 · coletado 01/11 05:00 primeiro registro

   NetamLoader .NET framework used in suspected supply chain attack on Asian government Windows 10 build

   ler a análise desta fonte ocultar

   Kaspersky disclosed a targeted intrusion against a government organization in Asia. The attackers deployed NetamLoader, a previously undocumented .NET assembly-loading framework, on a custom Windows 10 build used exclusively by government entities. The artifact was detected in the first half of 2026 and has not been attributed to any known actor. A supply chain compromise of a trusted third-party vendor is suspected, but the delivery vehicle for the CAB archive is unknown. Telemetry shows a single victim. The country was not disclosed, though signs point to China because of the Windows 10 China Government Edition.

   Technical Details

   • The payload was packaged in a Windows CAB file placed in C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24. Its contents were extracted to C:\Windows\SoftwareDistribution\Download\Install\.
   • The archive holds seven files, four of them legitimate Patch My PC components, including PatchMyPC-ScriptRunner.exe, its .config file and Microsoft.HostIntegration.Connectors.dll.
   • PatchMyPC-ScriptRunner.exe abuses AppDomainManager injection through its .config file to load Microsoft.HostIntegration.Connectors.dll. That DLL parses fabric.config and loads Resources.resx, the only file with embedded malicious code.
   • Resources.resx holds multiple layers of encoded, compressed or encrypted payloads (XAML files, .NET assemblies, JSON). XAML-2-1 bypasses AMSI. The .NET 1 Loader assembles XAML-3, reports status to the C2 and deletes extracted files, CLR usage logs and Prefetch entries.
   • XAML-3 runs inside dllhost.exe and loads the .NET 2 Plugin. The plugin collects system information from the Registry and waits a 20-40 minute random delay before contacting the C2 openaigpt4v[.]com. It then polls periodically and runs fetched XAML in an isolated AppDomain.
   • Polling pauses 5-6 minutes after a valid C2 response. Otherwise it pauses 22-28 hours, checking every 10 minutes.

   Remediation

   The article gives no explicit remediation. Defenders in similar environments can review SoftwareDistribution\Download for unexpected CAB content, monitor for .NET .config files that set AppDomainManager, and audit third-party endpoint management software and its vendors.