NetamLoader: How a .NET Supply Chain Implant Infiltrated Asian Government Networks Through Windows Update Directories
Executive Summary
In the first half of 2026, a previously undocumented .NET assembly-loading framework dubbed NetamLoader was discovered targeting a custom Windows 10 build used exclusively by government entities in Asia. The attack, uncovered by Kaspersky, is suspected to be a supply chain intrusion in which adversaries compromised a trusted third-party vendor to deliver a malicious Windows Cabinet (CAB) archive mimicking legitimate Patch My PC endpoint management components. The multi-stage payload chain exploited AppDomainManager injection to bypass antimalware defenses, established covert command-and-control communications via a domain impersonating OpenAI services, and deleted forensic artifacts to cover its tracks. The full scope of data exfiltration remains unconfirmed.
NetamLoader represents a significant escalation in state-level supply chain espionage tradecraft, combining living-off-the-land binaries, multi-layered XAML-based payload staging, and AMSI bypass within a single framework. As governments worldwide accelerate sovereign OS adoption, attackers are pre-positioning implants inside the very software update pipelines designed to secure those platforms, making detection and attribution exceptionally difficult.
Why This Matters Now
With China actively migrating state agencies away from Windows 10 Government Edition toward domestic Linux distributions, adversaries are racing to implant persistent footholds before that transition completes. The NetamLoader campaign exposes a critical blind spot: software update directories and trusted vendor toolchains remain largely unmonitored for east-west lateral movement and covert C2 beaconing, leaving sovereign government networks highly vulnerable during this sensitive migration window.
Attack Path Analysis
Attackers compromised a trusted third-party software vendor (Patch My PC) to deliver a malicious CAB archive into the Windows SoftwareDistribution update path on government-only Windows 10 systems in Asia, using AppDomainManager injection to load a multi-stage .NET assembly chain (NetamLoader) entirely within legitimate process memory. The implant bypassed AMSI, established a low-and-slow C2 polling loop to a typosquatted domain (openaigpt4v[.]com), collected system intelligence, and awaited operator-issued XAML payloads for further execution, while covering tracks by deleting artifacts and Prefetch cache entries; exfiltration and destructive impact remain unconfirmed but are structurally enabled by the C2 plugin framework.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers compromised a trusted third-party endpoint management vendor (Patch My PC) to insert a malicious .config file into a legitimate CAB archive. The archive was delivered into the Windows SoftwareDistribution download directory, mimicking a legitimate OS update package. AppDomainManager injection (T1574.014) was used to hijack .NET application-domain initialization and execute malicious assemblies inside the legitimate PatchMyPC-ScriptRunner.exe process, bypassing standard execution controls.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Hijack Execution Flow: AppDomainManager Injection
Obfuscated Files or Information
Impair Defenses: Disable or Modify Tools
Application Layer Protocol: Web Protocols
Process Injection
Indicator Removal
Command and Scripting Interpreter: Visual Basic
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malware Protection, Software Integrity, and Supply Chain Risk Management
Control ID: SI-3, SI-7, SA-12
CISA Zero Trust Maturity Model 2.0 – Application-Level Trust Verification and Behavioral Analytics
Control ID: Application Pillar: Application Access, Visibility and Analytics
NIS2 Directive – Supply Chain Security Obligations and Incident Notification
Control ID: Article 21 – Security of Network and Information Systems, Article 23 – Incident Reporting
DORA (Digital Operational Resilience Act) – Third-Party ICT Risk and Threat-Led Penetration Testing
Control ID: Article 28 – ICT Third-Party Risk Management, Article 10 – ICT Security Testing
PCI DSS 4.0 – Software Integrity, Malware Detection, and Third-Party Risk
Control ID: Requirement 6.3.3, Requirement 11.5.2, Requirement 12.8
ISO/IEC 27001:2022 – Vulnerability Management, Supply Chain ICT Security, and Operational Monitoring
Control ID: A.8.8 Management of Technical Vulnerabilities, A.5.21 Managing Information Security in the ICT Supply Chain, A.8.16 Monitoring Activities
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
NetamLoader's supply-chain espionage implant directly targets custom government Windows 10 builds in Asia, exploiting AppDomainManager injection to enable covert C2 polling, lateral movement, and sensitive data exfiltration from sovereign systems.
Information Technology/IT
Trusted third-party IT vendors like Patch My PC were weaponized as supply-chain vectors, enabling .NET assembly injection and AMSI bypass, exposing managed service providers and endpoint management software ecosystems to cascading downstream compromise.
Computer/Network Security
Multi-stage XAML and .NET payload obfuscation bypasses AMSI and clears Prefetch and CLR logs, directly challenging egress security, zero trust segmentation, and anomaly detection capabilities mapped to NIST.800-53.SC-7 and NIST.CSF.DE.CM-7.
Defense/Space
State-level espionage implant targeting government-exclusive OS builds signals high risk for defense-adjacent agencies, where encrypted C2 traffic to openaigpt4v[.]com and exfiltration gaps demand MACsec, IPsec, and egress policy enforcement per NIST.800-53.SC-12.
Sources
- NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injectionhttps://thehackernews.com/2026/11/netamloader-malware-targets-government.htmlVerified
- NetamLoader: A Sophisticated .NET Assembly-Loading Framework Targeting Government Systems in Asiahttps://securelist.com/netamloader/121676/Verified
- MITRE ATT&CK: AppDomainManager Injection (T1574.014)https://attack.mitre.org/techniques/T1574/014/Verified
- Announcing Windows 10 China Government Edition and the New Surface Prohttps://blogs.windows.com/windowsexperience/2017/05/23/announcing-windows-10-china-government-edition-new-surface-pro/Verified
- What is a Supply Chain Attack? - Cloudflare Learninghttps://www.cloudflare.com/learning/security/what-is-a-supply-chain-attack/Verified
- Windows Session Hijacking via CcmExec and AppDomainManager Injection - Google Cloud Threat Intelligencehttps://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexecVerified
- Antimalware Scan Interface (AMSI) - Microsoft Documentationhttps://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portalVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker relied on unconstrained outbound C2 reachability and implicit workload trust to sustain a covert espionage foothold inside government endpoints. By enforcing identity-aware segmentation and controlled egress policies, CNSF would likely reduce the attacker's ability to beacon outbound and pivot across similarly configured systems sharing the same update infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-wide policy visibility could limit how far a compromised software update package propagates across workloads by constraining implicit trust between endpoints sharing the same update path, reducing the reachability of the initial implant delivery across the managed government endpoint estate.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely reduce the scope of what a process operating under elevated context can reach across the workload environment, constraining lateral privilege scope even when the implant successfully inherits administrative permissions from a trusted management binary.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain workload-to-workload reachability across endpoints sharing the same update distribution path, reducing the attacker's ability to pivot laterally even if multiple hosts received the malicious package through the compromised vendor channel.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface anomalous outbound DNS resolution and encrypted polling traffic to an unrecognized external domain, reducing the attacker's ability to sustain a covert long-interval C2 loop without detection or policy-driven disruption across the monitored cloud egress path.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely reduce the attacker's ability to exfiltrate collected host metadata and registry artifacts by constraining outbound encrypted traffic to unauthorized external destinations, limiting the usable data exfiltration paths available through the same C2 channel.
If prior segmentation and egress controls constrained the C2 channel, the attacker's ability to issue destructive or exfiltration commands via operator-delivered XAML payloads would likely be reduced, limiting residual impact primarily to the initially compromised endpoint rather than extending across the broader government endpoint estate.
Impact at a Glance
Affected Business Functions
- Classified Government Communications and Secure Internal Networks
- National Security Policy and Intelligence Operations
- Government IT Supply Chain and Software Distribution Infrastructure
- Citizen and State Data Repositories
Estimated downtime: N/A
Estimated loss: N/A
The implant is designed for persistent espionage and covert surveillance of government-only Windows 10 systems. Data categories at risk include sensitive government communications, classified policy documents, personnel records of state employees, national security directives, and any data stored or processed on the compromised endpoint. The C2 polling loop via 'openaigpt4v[.]com' enables dynamic payload delivery, meaning the full scope of data exfiltration is unknown but could encompass any material accessible to the infected host. The deliberate targeting of a bespoke government OS build and the multi-stage AMSI bypass indicate a high-value intelligence collection objective rather than financial motivation. Financial loss is estimated at $0 direct cost given no ransomware or extortion component, but the strategic espionage value and remediation costs for a nation-state-level intrusion into sovereign government infrastructure are potentially very high.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement with FQDN filtering to block outbound connections to unrecognized or typosquatted domains such as openaigpt4v[.]com, preventing the .NET 2 Plugin from establishing its C2 polling loop even after successful implant delivery.
- • Enforce Zero Trust Segmentation and least-privilege identity-based policies on government endpoints to restrict lateral process injection paths — specifically preventing non-system processes like PatchMyPC-ScriptRunner.exe from spawning or injecting into trusted system hosts such as dllhost.exe without explicit policy authorization.
- • Apply Multicloud Visibility & Control with traffic observability and anomaly detection to baseline outbound HTTP/S polling patterns from government endpoints, flagging the low-and-slow jitter-delayed C2 beacon profile (20–40 minute initial delay, 22–28 hour dormancy cycles) as anomalous against established behavioral baselines.
- • Leverage East-West Traffic Security controls to monitor and restrict workload-to-workload communications originating from endpoints receiving updates via the SoftwareDistribution path, limiting the blast radius of any supply-chain-delivered implant from pivoting laterally across similarly configured government systems.
- • Implement Encrypted Traffic inspection and Inline IPS (Suricata) signatures targeting AppDomainManager injection patterns, AMSI bypass behaviors, and known NetamLoader XAML payload signatures to detect and block malicious assembly loading stages before the C2 channel is established, complementing supply chain integrity verification at the update package ingestion layer.
