APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments

A new malware framework called NetamLoader is being used against a custom version of Windows 10 that only government bodies in Asia use. The campaign looks like a supply-chain operation, and nobody has linked it to a known hacking group yet.

The malware hides inside a Windows update package, borrows trusted software to run, and deletes its own traces.

It also contacts its operators very slowly, so short security checks can miss it. Even a file that looks safe and signed by a known vendor can be part of an infection.

Analysts at Securelist, the research blog of Kaspersky’s GReAT team, identified the malware and published the full technical report on October 29, 2026.

Kaspersky first saw it in the first half of 2026, when its threat network flagged a suspicious .config file. The file sat inside a CAB archive in the folder where Windows keeps update packages.

APT Hackers Use NetamLoader Malware

At first, the archive looked harmless. Most files were real parts of Patch My PC, a third-party patch tool, and the .NET files used in the chain were signed by Microsoft.

Only one file, Resources.resx, held harmful code. Researchers did not see how the archive reached the victim. They also found no sign that Patch My PC itself was compromised.

The chain starts when PatchMyPC-ScriptRunner.exe runs. Its config file uses AppDomainManager injection in attacks to load code before the program’s main function starts.

That config points to a Microsoft-signed module, which reads a second file named fabric.config. This file makes Windows open Resources.resx, and a flaw in the old BinaryFormatter feature then runs the first hidden XAML script.

From there, the layers unpack one after another. Each layer is encoded, compressed, or encrypted, and the first decryption key comes from the command line of the running program.

If the command line is wrong, as in a sandbox, decryption fails and the program quietly exits. The second stage then turns off protection. A long XAML file patches the Windows Antimalware Scan Interface (AMSI) so every scan returns “clean.”

Its sensitive text is cut into tiny pieces so signature scanners cannot spot it. This is similar to other signed Intel utility campaign reports, where trusted tools helped attackers avoid detection.

Next, the first loader cleans up. It deletes the extracted files, .NET usage logs, and Prefetch files. It also removes lines from update logs in a folder named CmitUpdateAgent, which Kaspersky says may be tied to the custom government build.

It then uses a remote COM object to start the final payload inside dllhost.exe, which separates it from the first process and helps it slip past EDR behavior checks.

Slow Command Channel Keeps the Malware Hidden

The final piece, called the .NET 2 Plugin, talks to a command-and-control (C2) server at openaigpt4v[.]com.

The name looks like an AI service, but the domain sits behind Cloudflare. The malware waits 20 to 40 minutes before its first contact, which helps it outlast sandbox tests.

After a valid reply, it checks in every five to six minutes. If the server stays silent, it waits 22 to 28 hours and checks every ten minutes whether that time has passed.

A timer also closes the process after about 28 hours. All traffic uses AES encryption with an HMAC check, and the malware looks for a proxy in three different ways, so it can work in locked-down networks.

Downloaded XAML code runs in a temporary AppDomain that is removed afterwards. This keeps the main process stable and leaves less evidence behind.

The same habit of disabling scanners appears in a GhostContainer malware in Asia case, where the backdoor patched AMSI before doing anything else.

Kaspersky found only one victim through its telemetry. Because the malware was built for a government-only Windows build, the researchers believe the targets are Asian government bodies.

The report says countries building their own operating systems must protect the whole software chain themselves, and that this takes time.

Kaspersky detects the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast., and Trojan.Script.Agent.. Defenders should watch update folders for unexpected config files and signed programs that load code in odd ways.

They should also look for unusual Windows processes with outside connections and for missing log entries. Sending logs to a central server helps keep evidence if the malware wipes local copies.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.