NetamLoader: a stealthy .NET loader built for a government-only Windows 10 build

A previously undocumented malware framework dubbed NetamLoader has been found on a government system in Asia, running on a customized edition of Windows 10 that is issued only to state bodies. The infection chain hides inside legitimate, trusted software and goes to great lengths to stay invisible — classic espionage tradecraft, even though nobody has yet put a name to the operator.

What happened

The malicious package surfaced in the first half of 2026 as a Windows cabinet (CAB) archive dropped into C:\Windows\SoftwareDistribution\Download\ — the folder Windows uses to stage its own updates — and unpacked into an Install\ subfolder. Hiding among update files is a deliberate choice: it is a location few people ever inspect by hand.

How the archive got there is still unknown. A compromise of a trusted third-party vendor — a supply-chain intrusion — is considered a plausible route, but that has not been confirmed.

The archive holds seven files. Four are genuine components of Patch My PC, a legitimate endpoint patch-management tool; their presence does not by itself mean the tool's vendor was breached, since signed, trusted binaries are favourite camouflage. Only one file, Resources.resx, actually carries malicious code. The rest is plumbing:

1. Stage one. Running the legitimate PatchMyPC-ScriptRunner.exe makes .NET read a tampered .config file. Through AppDomainManager injection — abusing the way the .NET Framework initializes an application domain at startup — that config forces the trusted process to load Microsoft.HostIntegration.Connectors.dll, which in turn reads fabric.config and pulls in Resources.resx. The effect resembles DLL side-loading: hostile code runs inside a legitimate process.
2. Stage two. Resources.resx unwraps layer after layer of encoded, compressed and encrypted XAML, .NET assemblies and JSON. Along the way the chain patches the Antimalware Scan Interface (AMSI) to blind security tooling, executes inside dllhost.exe, and finally loads a .NET plugin that collects system details from the registry and talks to its command-and-control (C2) server at openaigpt4v[.]com.

Built for patience

NetamLoader is designed not to be noticed:

• it waits a random 20–40 minutes before its first call home;
• after a successful check-in it polls every 5–6 minutes for new XAML tasks, which it runs in an isolated AppDomain; if the server does not answer, it goes quiet for 22–28 hours;
• it deletes the files extracted from the CAB, along with CLR usage logs and Windows Prefetch entries, to wipe the forensic trail.

Why it matters

Only a single victim has been identified so far, and the activity has not been tied to any known threat group. It is also unclear whether more than one machine was compromised or whether any data was stolen. The targeted country has not been officially named, but the government-only Windows 10 build points toward China, where Microsoft supplies a dedicated Windows 10 China Government Edition to state agencies and state-owned enterprises. Beijing is also said to be steering some agencies to move away from that edition in favour of domestically built Linux distributions.

The broader lesson applies well beyond Asia: attackers increasingly ride on software you already trust. A legitimate, signed patch tool launching from the Windows Update folder will not trip many defences — and that is exactly the point.

What to do

• Watch .NET config files. Alert on new or modified *.exe.config files that declare a custom appDomainManagerAssembly or appDomainManagerType, especially next to signed binaries.
• Treat SoftwareDistribution\Download as sensitive. Executables, CAB archives or Install\ folders appearing there outside a normal update cycle deserve a closer look.
• Hunt for AMSI tampering and unusual dllhost.exe behaviour, such as loading .NET assemblies or making outbound connections.
• Flag anti-forensics. Bulk deletion of Prefetch files and CLR usage logs is rarely benign.
• Block and search for the C2 domain openaigpt4v[.]com in DNS and proxy logs.
• Vet your software supply chain. Inventory third-party management and patching tools, restrict who can push packages through them, and verify what they actually deploy.

Trusted-process abuse such as AppDomainManager injection is exactly what a well-scoped penetration test should probe. Our team can safely emulate this class of technique in your environment to show whether your endpoint controls and monitoring would catch it before a real attacker does.