Kaspersky has disclosed details of a sophisticated infection chain targeting government organizations in Asia. The operation deployed a previously undocumented .NET assembly-loading framework, which the researchers named NetamLoader, against a customized Windows 10 build reserved for government use.
The activity was detected during the first half of 2026. Kaspersky identified a single victim in Asia, but it has not determined whether the intrusion affected additional systems or resulted in the theft of sensitive information. The attack has also not been linked to any known threat actor or group.
The malware was packaged in a Windows cabinet archive placed in a directory used for Windows update packages. Researchers suspect a possible supply chain compromise involving a trusted third-party vendor, although the exact delivery method has not been established.
The archive contained seven files, including legitimate components associated with Patch My PC, an endpoint management application. The main execution file, PatchMyPC-ScriptRunner.exe, used its configuration file to trigger AppDomainManager injection and load Microsoft.HostIntegration.Connectors.dll. That component then processed another configuration file and loaded Resources.resx.
AppDomainManager injection abuses the .NET Framework application-domain initialization process to load arbitrary assemblies. In this case, the technique allowed malicious code to execute inside a legitimate application process, an approach comparable in effect to DLL sideloading.
Resources.resx contained several layers of encoded, compressed or encrypted content, including XAML files, .NET assemblies and JSON data. The subsequent stages included loaders designed to bypass the Antimalware Scan Interface, decrypt and assemble additional payloads, and load a .NET plugin.
The final components were designed to run through dllhost.exe. The .NET plugin read command-and-control configuration data, collected information from the Windows Registry and checked whether the current process was dllhost.exe. It then waited between 20 and 40 minutes before making its first request to the command-and-control server identified by Kaspersky as openaigpt4v[.]com.
Afterward, the malware entered a polling cycle to retrieve and execute XAML files inside an isolated AppDomain. When it received a valid response, it waited five to six minutes before making another request. If no valid response arrived, the interval extended to between 22 and 28 hours, with checks every 10 minutes.
NetamLoader also included measures intended to conceal the intrusion. Its components deleted malicious files extracted from the CAB archive, as well as CLR usage logs and Windows Prefetch cache files.
Kaspersky did not identify the targeted country. However, the researchers said the use of a government-specific Windows 10 build could indicate China, which has a version known as Windows 10 China Government Edition for government bodies and state-owned organizations. That assessment was presented as a possibility rather than a confirmed attribution.
Sources: The Hacker News.