NetamLoader: How an Unknown APT Weaponized a Government Windows Update Pipeline in Asia
Executive Summary
In the first half of 2026, Kaspersky researchers uncovered a sophisticated supply-chain attack targeting a customized Windows 10 build used exclusively by government entities in Asia. An unknown APT group, dubbed NetamLoader, embedded a multi-stage malicious framework inside a CAB archive disguised as a legitimate Patch My PC update package. The attack exploited AppDomainManager injection, .NET BinaryFormatter deserialization, TypeConfuseDelegate abuse, and AMSI bypass techniques across multiple XAML payload layers, ultimately deploying a C2-connected .NET plugin inside dllhost.exe. The attacker meticulously erased forensic evidence—log files, prefetch caches, and registry keys—while communicating over Cloudflare-hosted infrastructure at openaigpt4v[.]com with AES-128-CBC and HMAC-authenticated encrypted traffic.
This incident underscores the growing vulnerability of sovereign operating system supply chains as more governments pursue technological independence. Attackers are actively targeting the unique update and patch management ecosystems of custom government OS builds, exploiting immature supply-chain security practices before these platforms reach operational maturity.
Why This Matters Now
As geopolitical tensions accelerate national technology sovereignty initiatives, governments worldwide are deploying custom OS platforms with nascent supply-chain security controls. NetamLoader demonstrates that adversaries are already mapping and exploiting these emerging ecosystems—inserting malware into trusted update pipelines before defenders have established baseline protections, raising urgent concerns for any organization or government agency running custom or regionally-specific software stacks.
Attack Path Analysis
An unknown APT group compromised a custom government-only Windows 10 build in Asia by injecting a malicious CAB archive into the OS update package directory, abusing the legitimate Patch My PC update tool via AppDomainManager injection and a crafted .config file to silently load a multi-stage .NET/XAML loading framework (NetamLoader). The attack escalated privileges by verifying administrator context, patched AMSI in-memory to disable AV scanning, and used TypeConfuseDelegate and COM deserialization exploits to pivot execution into dllhost.exe, effectively breaking process lineage and evading EDR behavioral monitoring. The implant then established long-interval, AES-128-CBC+HMAC authenticated C2 communications over HTTPS to a Cloudflare-hosted domain masquerading as an OpenAI endpoint, exfiltrating system fingerprint data and awaiting further XAML payload delivery, while systematically erasing forensic artifacts including update logs, CLR usage logs, Prefetch files, and registry keys to maximize persistence and deniability.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
A malicious CAB archive was placed into the Windows OS update package staging directory (C:\Windows\SoftwareDistribution\Download\), targeting a custom government-only Windows 10 build. The archive contained a weaponized PatchMyPC-ScriptRunner.exe.config file that exploited AppDomainManager injection to load a Microsoft-signed but abused assembly (Microsoft.HostIntegration.Connectors.dll), triggering a chain that parsed a crafted fabric.config and a malicious Resources.resx file containing BinaryFormatter-deserialized payloads. The delivery mechanism was a supply-chain compromise of the patch management update pipeline.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
AppDomainManager Injection
Command and Scripting Interpreter: Visual Basic / XAML Execution
Obfuscated Files or Information: Encrypted/Encoded File
Impair Defenses: Disable or Modify Tools (AMSI Bypass)
Process Injection: Process Hollowing / Remote COM Object Abuse via dllhost.exe
Application Layer Protocol: Web Protocols (HTTPS C2 over Cloudflare CDN)
Indicator Removal: Clear Windows Event Logs and Prefetch Files
Deobfuscate/Decode Files or Information
Virtualization/Sandbox Evasion: Time Based Evasion (20-40 minute jitter, 28-hour polling delays)
Query Registry (SusClientId, .NET version, Windows build info collection)
Modify Registry (Exception-state GUID key manipulation, COM DllSurrogate registration)
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Software and Information Integrity / Supply Chain Protection
Control ID: SI-7 / SA-12
CISA Zero Trust Maturity Model 2.0 – Workload Isolation and Runtime Behavioral Monitoring
Control ID: Application Pillar – Application Access / Workload Security
NIS2 Directive (EU) 2022/2555 – Supply Chain Security and Incident Detection Obligations
Control ID: Article 21 – Cybersecurity Risk Management Measures
DORA (EU Regulation 2022/2554) – ICT Supply Chain Risk and Operational Resilience Testing
Control ID: Article 9 – ICT Security Policies / Article 13 – ICT Third-Party Risk
ISO/IEC 27001:2022 – Vulnerability Management, Outsourced Development, and Supply Chain Information Security
Control ID: Annex A 8.8 / A 8.30 / A 5.21
PCI DSS 4.0 – Security Vulnerability Management and Third-Party Risk Management
Control ID: Requirement 6.3 / 12.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Primary APT supply-chain target: NetamLoader exploits customized Asian government Windows builds via update pipelines, enabling lateral movement, AMSI bypass, and AES-encrypted C2 exfiltration evading compliance controls.
Information Technology/IT
Patch management supply-chain compromise via PatchMyPC hijack exposes IT operations to AppDomainManager injection, ETW suppression, and covert dllhost.exe persistence requiring Zero Trust segmentation and egress enforcement.
Computer/Network Security
AMSI virtual-table patching and TypeConfuseDelegate abuse directly undermine endpoint security tooling, demanding inline IPS, multicloud visibility, and anomaly detection to identify covert C2 polling over Cloudflare CDN infrastructure.
Defense/Space
Geopolitically motivated APT targeting sovereign OS ecosystems threatens defense-adjacent government entities, with 28-hour sandbox-evasion timers and encrypted AES-HMAC C2 traffic bypassing standard perimeter exfiltration controls.
Sources
- Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asiahttps://securelist.com/netamloader/121676/Verified
- MITRE ATT&CK: AppDomainManager Injection (T1574.014)https://attack.mitre.org/techniques/T1574/014/Verified
- MITRE ATT&CK: Subvert Trust Controls: AMSI Bypass (T1562.001)https://attack.mitre.org/techniques/T1562/001/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
- Microsoft Security Advisory: BinaryFormatter Deserialization Riskshttps://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guideVerified
- Kaspersky Securelist - Threat Intelligence Reportshttps://securelist.com/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker relied on unconstrained outbound HTTPS reach and assumed broad east-west reachability within government infrastructure to sustain covert C2 and enable follow-on payload delivery. By enforcing identity-aware segmentation and controlled egress policies across workloads, Aviatrix CNSF would likely reduce the attacker's ability to communicate freely with external operator infrastructure and limit lateral pivot scope across the environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The segmentation fabric would likely constrain the reach of the compromised update pipeline workload, reducing how freely the initially infected host could initiate outbound or lateral connections immediately following compromise.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely reduce the privilege scope available to the compromised process by constraining which network paths and workload resources the escalated session could reach, even after local privilege elevation occurred on the host.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to pivot laterally across workloads or hosts within the government network, reducing the reachability of any injected process attempting to initiate connections to adjacent systems.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and policy control would likely surface and constrain unauthorized outbound HTTPS sessions initiated by workloads, reducing the attacker's ability to maintain reliable long-interval C2 polling to external Cloudflare-hosted infrastructure from within the government environment.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely reduce the attacker's ability to successfully transmit encrypted fingerprint and execution data outbound, constraining the exfiltration channel the implant relied on to report back host intelligence to the operator.
If prior segmentation and egress controls had constrained C2 reachability and lateral pivot scope, the attacker's ability to deploy follow-on XAML payloads and expand covert access across additional government workloads would likely have been reduced, limiting the long-term intelligence collection footprint even if the initial compromise occurred.
Impact at a Glance
Affected Business Functions
- Government OS Update and Patch Management Infrastructure
- Classified and Sensitive Government Data Processing
- Government Network Command and Control Communications
- Endpoint Security and Anti-Malware Operations (AMSI)
Estimated downtime: N/A
Estimated loss: N/A
The implant targets a custom Windows 10 build used exclusively by Asian government entities, meaning potential exposure includes sensitive government operational data, system configuration details (registry keys, SusClientId values, Windows Update metadata), and any classified or restricted information accessible from compromised government endpoints. The .NET 2 Plugin establishes a persistent, encrypted C2 channel capable of receiving and executing arbitrary XAML payloads, enabling exfiltration of any data accessible on the infected system. The long polling intervals (22-28 hours) and sandbox evasion suggest a prolonged, stealthy intelligence-collection operation. Forensic artifacts are actively deleted including CLR usage logs, Windows Prefetch cache files, and update records, indicating deliberate operational security to conceal the scope of access. Given the government-only target profile, the data at risk likely includes sensitive governmental communications, policy documents, infrastructure configuration data, and potentially classified national security information.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement with FQDN filtering to block outbound HTTPS connections to unauthorized or anomalous domains such as openaigpt4v[.]com masquerading as AI service endpoints; enforce allowlist-based egress policies that require explicit approval for any application-to-internet traffic originating from government workstations, preventing the C2 polling loop from ever reaching Cloudflare-hosted infrastructure.
- • Implement Multicloud Visibility & Control with centralized traffic observability to detect anomalous outbound HTTPS beaconing patterns characterized by extremely long polling intervals (22-28 hours), encrypted query-parameter payloads, and User-Agent header manipulation; baselining normal OS update traffic against observed deviations would flag the openaigpt4v[.]com connections as high-priority incidents requiring immediate investigation.
- • Apply Zero Trust Segmentation with identity-based microsegmentation policies to restrict the Windows update staging directory and patch management processes (PatchMyPC-ScriptRunner.exe) to only their required network destinations and system resource access; least-privilege namespace enforcement would prevent the process from spawning COM objects, performing RPC-based remote process injection into dllhost.exe, or accessing AMSI virtual memory regions outside its defined trust boundary.
- • Enable Inline IPS (Suricata) inspection on outbound traffic to detect known-bad payload signatures within XAML and .NET assembly loading patterns, BinaryFormatter deserialization exploit traffic, and TypeConfuseDelegate abuse indicators; while encrypted C2 traffic limits deep inspection post-encryption, IPS rules targeting the initial CAB delivery mechanism, malformed .config file structures, and COM deserialization exploit patterns at the network layer can interrupt the kill chain at the Initial Compromise and Privilege Escalation stages before AMSI is disabled.
- • Leverage Cloud Native Security Fabric (CNSF) with real-time inline enforcement and distributed policy to apply consistent control-plane visibility across the government cloud and on-premises hybrid environment; CNSF's cloud-native enforcement capabilities should be configured to monitor and alert on ETW suppression attempts (COMPlus_ETWEnabled=0), anomalous AppDomain creation with GUID-randomized names, RPC-based dllhost.exe child process spawning from update management tools, and registry key deletion patterns matching the nine-GUID exception-state cleanup signature documented in this threat.
