Cybersecurity researchers have uncovered a sophisticated malware infection campaign targeting government organizations in Asia, involving a previously undocumented .NET assembly-loading framework known as NetamLoader.
The campaign reportedly targets a customized Windows 10 operating system build used exclusively by certain government entities in the region. The attackers employ a complex, multi-stage infection chain designed to execute malicious .NET assemblies while attempting to evade security detection.
The investigation identified the malware during the first half of 2026. However, the operation has not been attributed to any known threat actor or cybercriminal group.
It also remains unclear whether the attackers compromised multiple systems or successfully stole sensitive government information.
Researchers suspect the campaign may involve a software supply chain compromise, potentially allowing attackers to exploit a trusted third-party vendor to reach organizations using its software or services.
NetamLoader Malware Hidden Inside Windows Update Directory
The investigation uncovered a Windows Cabinet (CAB) archive containing malicious configuration files placed inside a directory normally used to store Windows operating system update packages.
The archive was discovered in the following location:
C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24
Its contents were subsequently extracted into:
C:\Windows\SoftwareDistribution\Download\Install\
The archive contained a .config file designed to abuse a technique known as AppDomainManager injection.
This technique exploits the .NET Framework’s application-domain initialization mechanism to load unauthorized .NET assemblies when a legitimate application starts.
By manipulating the application’s configuration, attackers can execute malicious code inside a trusted process, making the activity more difficult to distinguish from legitimate software operations.
The technique shares similarities with DLL sideloading, where malicious components are loaded through legitimate applications to evade security monitoring.
First Stage of the NetamLoader Infection Chain
The CAB archive contained seven files, including four legitimate components associated with Patch My PC, an endpoint management software platform.
The identified files were:
fabric.configMicrosoft.HostIntegration.Connectors.dllPatchMyPC-Enum.dllPatchMyPC-Models.dllPatchMyPC-ScriptRunner.exePatchMyPC-ScriptRunner.exe.configResources.resx
Researchers found that the files did not directly contain malicious code, with the exception of Resources.resx, which stored encoded and concealed payload data.
The first stage of the infection chain involved the legitimate executable PatchMyPC-ScriptRunner.exe.
When executed, the program processed its associated configuration file and abused AppDomainManager injection to load Microsoft.HostIntegration.Connectors.dll.
The loaded component then located fabric.config in the same directory and used its contents to access and process Resources.resx.
The resource file contained multiple layers of encoded, compressed, and encrypted content, including XAML documents, .NET assemblies, and JSON data.
These components were subsequently decoded and loaded as the infection progressed.
Second Stage Deploys Multiple Malicious Payloads
The second stage involved several interconnected payloads designed to load additional malicious components, bypass security monitoring, and establish communication with remote infrastructure.
Researchers identified the following components:
1. XAML-1
An initial loader responsible for accessing and executing another embedded payload identified as XAML-2.
2. XAML-2
The next component in the infection chain, responsible for loading two compressed and Base64-encoded XAML files known as XAML-2-1 and XAML-2-2.
One of these components was designed to interfere with the Antimalware Scan Interface (AMSI), a Windows security feature used to inspect potentially malicious scripts and content.
3. XAML-2-2
This component contained two main elements: a .NET module known as the .NET 1 Loader and a JSON data payload identified as JSON-1.
4. JSON-1
The JSON payload contained two important components:
JSON-1-c, which stored command-and-control (C2) server configuration information.JSON-1-p, which contained a Base64-encoded .NET 2 Plugin and a collection of compressed and encrypted XAML templates used to construct another payload known as XAML-3.
5. .NET 1 Loader
This component was responsible for decrypting, assembling, and loading XAML-3. It also reported execution status to the remote C2 server.
Additionally, it attempted to remove malicious files extracted from the original CAB archive, along with certain .NET runtime logs and Windows Prefetch cache files that could help investigators reconstruct the infection.
6. XAML-3
The next payload executed inside the legitimate Windows process dllhost.exe.
Its primary purpose was to decode, decompress, and load the final malicious .NET component.
7. .NET 2 Plugin
The final plugin collected system information from the Windows Registry, retrieved the C2 configuration, and checked whether it was running inside dllhost.exe.
It then established communication with the attacker’s remote infrastructure.
Malware Uses Delayed Communication to Avoid Detection
One particularly notable feature of NetamLoader is its delayed communication mechanism.
After initializing, the .NET 2 Plugin waits for a randomly selected period of approximately 20 to 40 minutes before making its first request to the command-and-control server.
The server identified during the investigation was:
openaigpt4v[.]com
Once communication begins, the malware enters a recurring polling process to retrieve additional XAML payloads and execute them within an isolated .NET application domain.
Researchers identified two different waiting periods depending on the server’s response.
- When a valid response is received, the malware waits approximately 5 to 6 minutes before sending another request.
- When no valid response is received, it waits approximately 22 to 28 hours, periodically checking whether the waiting period has expired.
Such delayed communication can make malicious network activity less obvious and complicate detection during routine security monitoring.
The modular design also allows attackers to deliver additional functionality without placing every malicious component on the compromised system at once.
Government-Specific Windows 10 Build Under Attack
Telemetry collected during the investigation identified a single victim in Asia.
Researchers found that NetamLoader was specifically designed to target a customized Windows 10 build reportedly used by government organizations.
Although the affected country was not officially identified, the findings point toward the possibility of China.
Microsoft offers a specialized operating system known as Windows 10 China Government Edition, designed for use by Chinese government organizations and state-owned enterprises.
The customized operating system is therefore one possible explanation for the specific environment targeted by the malware.
However, the available findings do not conclusively establish that the victim was located in China or that the targeted system was running this particular Windows edition.
China Reportedly Moves Away From Windows Government Edition
The discovery comes amid broader efforts by Chinese authorities to reduce reliance on foreign technology within government institutions.
In August 2026, reports indicated that China’s Ministry of State Security had instructed certain government agencies to stop using Windows 10 Government Edition and transition toward domestically developed Linux distributions.
The reported move was driven by concerns about data security and dependence on foreign software platforms.
The development highlights the growing importance of protecting government-specific operating systems, software supply chains, and supporting infrastructure against sophisticated cyber threats.
Growing Security Risks for Government-Controlled Software Platforms
The NetamLoader campaign demonstrates how attackers can exploit trusted software components and legitimate application processes to establish a foothold inside sensitive environments.
The use of multiple loading stages, encrypted payloads, delayed C2 communication, and attempts to remove forensic evidence makes the infection chain particularly difficult to investigate.
The incident also highlights the security challenges associated with government-specific operating systems and customized software ecosystems.
As more countries develop their own operating systems, databases, middleware, and cloud platforms, protecting the entire software supply chain becomes increasingly important.
Government organizations must ensure that third-party software providers, update mechanisms, application configurations, and internal development environments are subject to continuous security assessments.
Ultimately, the NetamLoader discovery serves as a reminder that even customized and restricted operating system environments can become targets of sophisticated supply chain attacks.
