NetamLoader: How a .NET Supply Chain Implant Infiltrated Asian Government Networks Through Windows Update Directories
In the first half of 2026, a previously undocumented .NET assembly-loading framework dubbed NetamLoader was discovered targeting a custom Windows 10 build used exclusively by government entities in Asia. The attack, uncovered by Kaspersky, is suspected to be a supply chain intrusion in which adversaries compromised a trusted third-party vendor to deliver a malicious Windows Cabinet (CAB) archive mimicking legitimate Patch My PC endpoint management components. The multi-stage payload chain exploited AppDomainManager injection to bypass antimalware defenses, established covert command-and-control communications via a domain impersonating OpenAI services, and deleted forensic artifacts to cover its tracks. The full scope of data exfiltration remains unconfirmed. NetamLoader represents a significant escalation in state-level supply chain espionage tradecraft, combining living-off-the-land binaries, multi-layered XAML-based payload staging, and AMSI bypass within a single framework. As governments worldwide accelerate sovereign OS adoption, attackers are pre-positioning implants inside the very software update pipelines designed to secure those platforms, making detection and attribution exceptionally difficult.
Kill Chain
