NetamLoader Hits Asian Government Windows 10: The Paradox of Technological Sovereignty

On October 29, 2026, Kaspersky published its analysis of NetamLoader, a previously undocumented .NET malware framework that targeted a custom version of Windows 10 used exclusively by governments in Asia. The attack leverages legitimate software components — including Microsoft-signed files — to conceal a multi-stage infection chain that culminates in an in-memory antimalware bypass. The discovery raises direct questions about who has access to the distribution channels of an operating system considered sovereign.

The Compromised Trust Chain: From Signed Files to In-Memory Execution

The infection starts from a CAB archive placed in C:\Windows\SoftwareDistribution\Download\, the folder Windows uses for staging updates. According to Kaspersky, most files inside were legitimate: Patch My PC components and Microsoft-signed assemblies. This camouflage renders the attack invisible to defenses based solely on signer reputation.

The attackers modified a .config file to force the loading of an arbitrary .NET assembly via AppDomainManager injection into the legitimate PatchMyPC-ScriptRunner.exe process. The malicious assembly then exploits a design vulnerability in DataCacheFactoryConfiguration, a component of the Windows Server AppFabric Cache Client signed by Microsoft, to load a .resx file containing objects serialized with BinaryFormatter.

Deserialization triggers a TypeConfuseDelegate chain leading to XAML code execution. The first XAML stage derives the AES key from the host process command line using SHA-256; the IV resides in the first 16 bytes of the payload. If derivation fails, the malware exits silently via Environment.Exit(0), avoiding suspicious activity.

The second XAML stage (XAML-2-1) performs the in-memory AMSI bypass. It does not modify Windows Defender code: it redirects the CAmsiAntimalware::Scan pointer in the vtable to Console.Clear(), overwriting the instruction with the bytecode 41 C7 00 01 00 00 00 33 C0 C3 to permanently return AMSI_RESULT_CLEAN. VirtualProtect enables the pointer modification without altering the AMSI module on disk.

The final payload operates in dllhost.exe via remote COM. This host process choice serves to evade EDR monitoring, which often treats dllhost.exe as legitimate OS activity.

"Technological sovereignty has become a priority for many governments, and operating systems are often where it starts. Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature." — Sergey Lozhkin, head of Kaspersky GReAT Research Center, APAC & META

A Bespoke Weapon Against a Target of One

Kaspersky detected a single victim and did not link the attack to any known APT. The compromised system is not a standard Windows distribution: it is a custom build used exclusively by government entities in Asia. The malware includes specific logic to wipe trace files of an update component unique to that OS, and to disable .NET ETW (Event Tracing for Windows), reducing forensic visibility.

The information-gathering plugin implements deliberate timing: it waits 20–40 minutes before the first contact with the C2 server, and 22–28 hours between attempts if no response is received. Encrypted traffic uses AES-128-CBC with HMAC; the domain impersonates an AI service and sits behind Cloudflare, making infrastructure-level blocking difficult without payload analysis.

The combination of extremely narrow targeting, detailed knowledge of the government OS, and access to the update distribution channel suggests an actor with significant resources and visibility into the target's supply chain. This is not malware designed for mass spread: it is a precision tool.

Supply Chain or Insider Access: The Delivery Point Remains Dark

Kaspersky states that the presence of the CAB archive in the updates folder "strongly indicates a supply-chain attack." However, the primary technical source does not confirm that the Windows update infrastructure or Patch My PC's infrastructure were actually compromised. It remains unknown how the CAB file reached the victim machine: compromise of the update server, physical access, lateral movement from another system on the same network, or another undocumented vector.

The security firm explicitly rules out that Patch My PC or Microsoft were breached as entities. The legitimate components were not altered at the source: they were abused in the victim's distribution context. This distinction is crucial for risk assessment: the problem is not the signed code, but the context in which it executes.

The design flaw in DataCacheFactoryConfiguration is not a zero-day vulnerability in the classic sense: it is a known architectural weakness that allows loading of external resources, abused in combination with other techniques to achieve execution. No unpublished CVE is required for the attack to be effective.

The Sovereignty Paradox: Autonomy That Isolates from Control

The NetamLoader case illustrates a structural contradiction of government operating systems. The targeted Windows 10 build offers autonomy from Microsoft's decisions, but creates a maintenance and update ecosystem with reduced visibility compared to the global supply chain. "The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process. On the other hand, it also means that each country must protect this entire vast ecosystem on its own," reads the Kaspersky report cited by The Record.

This dualism has immediate operational consequences. Update channels of a custom OS do not benefit from the same community scrutiny and commercial pressure that force global vendors to invest in supply-chain security. An attacker who identifies this asymmetry can concentrate resources on an attack vector with lower detection probability.

For organizations managing Windows environments even in standard versions, the case introduces a judgment variable: the Microsoft signature is no longer a sufficient indicator of harmlessness. The relevant question is not "is it signed?" but "how do components interact with each other and from what distribution context do they originate?"

What to Do Now

The following actions derive directly from the evidence documented by Kaspersky:

• Check for modified .config files next to .NET executables in update directories, with particular attention to SoftwareDistribution\Download\ and similar paths.
• Analyze dllhost.exe execution logs with unexplained remote COM activation, especially when associated with processes that normally do not require network communication.
• Monitor BinaryFormatter usage in .NET environments: the class is deprecated for documented security risks, and its presence in .resx files or other serialized resources requires manual inspection.
• Audit internal software distribution channels: compromise of the update vector is indistinguishable from legitimate activity until the archive content is analyzed, not just the signature.

Precision as a Signature

NetamLoader leaves no room for interpreting an opportunistic attack. The absence of attribution to a known APT does not equal absence of sophistication: the multi-stage architecture, the targeting of an OS with restricted access, and the selective wiping of logs from a specific component indicate design for defined objectives. The only unknown remains who commissioned and deployed the weapon.

For Asian governments with similar sovereign OS projects, the message is simultaneously technical and political. Code sovereignty does not automatically extend to supply-chain sovereignty: building an alternative OS is only the first stage of a trust chain that includes updates, third-party tools, and the ability to detect anomalies in contexts designed to appear legitimate. NetamLoader has demonstrated that this chain, under specific conditions, is more fragile than the sum of its apparently reliable links.

FAQ

Does NetamLoader only target Asian government Windows systems?

According to Kaspersky, the confirmed victim is a single one using a custom Windows 10 build exclusive to Asian governments. The malware includes logic specific to that system. It is not known whether the framework can operate on standard Windows or has been re-adapted.

Were Patch My PC and Microsoft compromised?

No. Kaspersky explicitly rules out that the vendors were breached. Attackers abused legitimate components already present or distributed in the victim's context, not altered at the original source.

Why is there no attribution to an APT?

Kaspersky states it found no infrastructural or technical overlaps linking NetamLoader to known groups. This does not rule out future attributions, but at present there is no public evidence of connection with documented campaigns.

Sources

• therecord.media
• securelist.com
• kaspersky.com
• securityonline.info
• thehackernews.com
• blog.talosintelligence.com
• thehackernews.com
• thehackernews.com