NetamLoader Uses AppDomainManager Injection on Custom Asian Government Windows 10 Builds
NetamLoader represents an unattributed .NET injection campaign against restricted Asian government Windows 10 systems via suspected supply-chain compromise of endpoint management software. The multi-stage XAML and JSON payload chain evades AMSI and cleans traces, but limited victim data leaves scope unclear. Future detections will hinge on whether the same CAB artifact or C2 infrastructure resurfaces.
The infection chain begins with PatchMyPC-ScriptRunner.exe parsing a .config file to load Microsoft.HostIntegration.Connectors.dll, which then decrypts layered payloads from Resources.resx including XAML loaders, an AMSI bypass, and a .NET 2 Plugin. The CAB contents were extracted into the Install subdirectory, after which the malware reported to C2 via JSON-1-c configuration and wiped prefetch and CLR logs. Evidence points to a supply-chain compromise of the Patch My PC updater rather than direct phishing. No independent technical attribution exists; Kaspersky notes only that the target build is restricted to Asian government entities and that impact beyond a single system remains unconfirmed. Similar AppDomainManager techniques have appeared in prior .NET loaders tied to espionage groups, yet this sample shows no code overlap with known families. The placement inside the Windows update directory suggests the actor anticipated routine patch traffic to mask delivery.
SENTINEL: At least two additional NetamLoader samples will be reported in other Asian government environments by mid-2027.
Sources (2)
- [1]The Hacker News Kaspersky Coverage(https://thehackernews.com/2026/11/netamloader-malware-targets-government.html)
- [2]Kaspersky Threat Intelligence Report(https://securelist.com/netamloader-analysis/)