NetamLoader Hides in Windows Update Folder in Suspected Supply Chain Attack on Asian Government
Do Son 
Infection chain: Stage 2 | Image: Kaspersky Labs
TL;DR
In the first half of 2026, Kaspersky found a malicious CAB archive sitting in a Windows update download folder. It led to NetamLoader, a new .NET loader built on XAML markup. Kaspersky says the evidence “strongly indicates a supply-chain attack” on a custom Windows build used only by Asian government bodies.
What happened
The trail began with a Kaspersky Security Network alert on a single .config file. At first, the CAB archive looked clean. Most of its programs were legitimate parts of the Patch My PC patch management tool. Even the .NET assemblies used in the attack carried Microsoft signatures.
However, a closer look revealed a long, hidden infection chain. Kaspersky did not see how the CAB file reached the victim. It only saw a Patch My PC component launched with update arguments.
Stage 1: Abusing trusted .NET parts
The attack used AppDomainManager injection. This trick loads a chosen .NET assembly before the host program’s main code runs. The config file pointed to a Microsoft-signed caching library with a design flaw.
That flaw let the attackers load a resource file packed with hidden payloads. Parsing it triggered an unsafe .NET deserialization step, which then ran XAML code. XAML is normally used to build app interfaces, but it can also express program logic.
Notably, the first XAML layer built its decryption key from the host process’s command line. If anything failed, the process quietly closed to avoid error messages.
Stage 2: Blinding defenses
The next layer patched Windows AMSI so every scan returned “clean.” It did this by redirecting a pointer in memory rather than changing the AMSI code itself. As a result, the malware could pass code integrity checks.
A first .NET loader then wiped its tracks. It deleted the dropped files, CLR usage logs, and Prefetch entries. It also scrubbed matching lines from update logs tied to a component that Kaspersky links to a custom Windows 10 build for an Asian government.
Next, it turned off .NET event tracing for the process. Finally, it abused a remote COM object to load the next payload inside a fresh dllhost.exe process. Kaspersky says this separates the chain from its original process to “bypass behavioral monitoring by security solutions such as EDR.”
How NetamLoader talks to its server
Inside dllhost.exe, NetamLoader loads a plugin that gathers basic system details. It waits 20 to 40 minutes before its first contact to outlast sandboxes. After that, it polls its server every 22 to 28 hours if no reply comes.
All traffic is protected with AES-128-CBC and HMAC. The plugin also finds the system proxy in three ways so it can reach the internet from locked-down networks.
The server sends back new XAML code. NetamLoader runs it inside a separate, short-lived AppDomain and then unloads it. This keeps payloads out of the main process and cleans up after each run. The command server’s domain mimics an AI service name and sits behind Cloudflare.
Who is behind it
Attribution remains open. Kaspersky says that after reviewing TTPs, code, and infrastructure, “we were unable to link the attack to any known APT group.” No suspects have been named.
It is also worth stressing what the report does not say. Kaspersky does not claim that Patch My PC itself was breached. Instead, the attackers bundled its legitimate files with malicious config and resource files.
Impact and scale
Kaspersky’s telemetry shows a single victim in Asia. However, the malware was built for a government-only version of Windows. Kaspersky therefore infers that the targets are Asian government entities.
The design points to long-term espionage. NetamLoader runs mostly in memory, erases forensic traces, and checks in rarely. Each of these choices makes it harder to spot.
What comes next
Kaspersky ties the case to a broader trend. More countries now build their own operating systems and software stacks. As the report notes, that means “each country must protect this entire vast ecosystem on its own.” Until those supply chains mature, they may offer new ways in.
Kaspersky detects the threat as HEUR:Trojan.MSIL.NetamLoader.gen and related names.
How to stay protected
- Check Windows update download folders for unexpected CAB files and .config files.
- Alert on AppDomainManager entries in .config files next to signed executables.
- Watch for .resx files that contain serialized binary objects.
- Monitor dllhost.exe for unusual .NET activity or outbound network traffic.
- Flag processes that set COMPlus_ETWEnabled to 0.
- Audit the integrity of internal update servers and patch packages.
In short, NetamLoader shows how a suspected supply chain attack can hide inside the very update process meant to protect government systems.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
