Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files

Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup.

It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it.

NetamLoader malware

Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load arbitrary .NET assemblies. The file sat inside a CAB archive in C:\Windows\SoftwareDistribution\Download.

Most of the CAB contents were legitimate Patch My PC components, and the injected assemblies were Microsoft-signed. Only Resources.resx was malicious.

According to technical research published by Kaspersky, PatchMyPC-ScriptRunner.exe loads a crafted config file that points to Microsoft.HostIntegration.Connectors.

The DataCacheFactoryConfiguration class then reads fabric.config, which parses Resources.resx. That file holds a Base64 BinaryFormatter object. It triggers a TypeConfuseDelegate deserialization attack and calls XamlReader.Parse() to run the first XAML payload.

XAML-1 derives an AES key from the SHA-256 hash of the host’s command line and decrypts XAML-2. If decryption fails, the process exits silently. XAML-2 unpacks two further components: XAML-2-1, which hijacks AMSI by redirecting the CAmsiAntimalware::Scan pointer to a patched Console.Clear() so every scan returns clean, and XAML-2-2, which delivers the .NET 1 Loader and its JSON C2 configuration.

The loader erases update records, CLR usage logs and Prefetch files. It also strips GetExtendedUpdateInfoHandler entries from CmitUpdateAgent logs, which may point to the custom government Windows build.

It then uses an RPC-created COM object to launch XAML-3 inside dllhost.exe, separating the payload from the original process tree to evade EDR. This resembles other AMSI-evading loaders seen this year.

The final plugin waits 20–40 minutes before first contact, which defeats sandboxes. It then polls its C2 every 5–6 minutes, or every 22–28 hours after a failure.

Traffic uses AES-128-CBC with HMAC-SHA256, and the plugin accepts any certificate. Downloaded XAML runs in an isolated AppDomain. A watchdog timer terminates the process after about 28 hours.

The C2 is openaigpt4v[.]com, behind Cloudflare at 104.18.14[.]219. Kaspersky saw one victim in Asia and infers a wider government focus.

Defenders should watch for unexpected .config files beside .NET executables, especially in SoftwareDistribution\Download\Install. They should also alert on AMSI tampering and dllhost.exe launched through COM.

As another update-channel abuse case shows, trusted update workflows are an increasingly attractive target. Full technical details are in Kaspersky’s NetamLoader report.