NetamLoader: unknown APT hits government-only Windows 10 in Asia

Kaspersky's GReAT team has documented NetamLoader, a previously undocumented .NET assembly-loading framework used to attack a custom Windows 10 build reserved for government use in Asia. The full technical writeup is on Securelist; The Hacker News summarizes it. Kaspersky found a single victim and has not attributed the activity to any known group.

What NetamLoader is

Kaspersky describes it as "a complex .NET assembly-loading framework built on XAML markup" — a multi-stage loader that runs attacker code inside signed, legitimate Windows processes to stay out of sight. The target was a government-only variant of Windows 10, which is why Kaspersky assesses the intended victims as government entities in the region. Kaspersky did not name the country.

The infection chain

Initial delivery was not observed — Kaspersky suspects a supply-chain compromise but could not confirm the vehicle. What it reconstructed:

1. A CAB archive lands in the Windows Update download folder; PatchMyPC-ScriptRunner.exe runs with -updatepackage, and most extracted files are legitimate Patch My PC components.
2. AppDomainManager injection: the executable's .config loads a Microsoft-signed assembly — the injection rides signed code.
3. A crafted fabric.config drives ResXResourceSet to parse Resources.resx, which holds a Base64 object deserialized with the "well-known, highly vulnerable .NET BinaryFormatter class," yielding the first XAML stage.
4. Later stages bypass AMSI and build an encrypted payload; the final .NET 2 Plugin runs inside dllhost.exe, reached through a remote COM object — which, per Kaspersky, "effectively separates the infection chain from its initial process."

Indicators of compromise

Published verbatim by Kaspersky (Securelist):

C2 domain:  openaigpt4v[.]com   (104.18.14[.]219, Cloudflare CDN; domain first seen 2023-09-27)

Staging path: C:\Windows\SoftwareDistribution\Download\Install\
  PatchMyPC-ScriptRunner.exe.config
  fabric.config
  Resources.resx

MD5:
  F2458ED133F8D0CA19E22C10F577E98E   CAB archive
  E1DC6F1ED193594F2284BE22AE08DFA4   Resources.resx
  AB81564BCB8CA7E710C66832DE747556   .NET 1 Loader
  CFB8B281BDF5D9390E64B10C312FB2C1   .NET 2 Plugin

Kaspersky products detect the components as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*. Note the C2 domain impersonates an AI brand; the campaign itself is espionage tooling, not AI-related.

Action checklist

1. Hunt for the staging path and hashes above across endpoints, especially the PatchMyPC-ScriptRunner.exe.config / fabric.config / Resources.resx trio in the Windows Update download folder.
2. Block and alert on openaigpt4v[.]com at DNS and proxy layers.
3. Watch for AppDomainManager injection — anomalous .config files alongside signed .NET binaries, and child code executing from dllhost.exe via remote COM.
4. Review Patch My PC deployment integrity if you run it; the actor abused its signed ScriptRunner component as the launch point.

Context

NetamLoader is a clean example of the direction of modern intrusion tooling: no custom dropper to flag, just legitimate signed binaries (AppDomainManager injection, abused Patch My PC components) chained with an old, dangerous .NET primitive (BinaryFormatter deserialization) and process-hopping into dllhost.exe to break the forensic thread. Attribution is absent here, which is the honest position — a single victim and a shared-technique toolkit are not enough to name a group. Treat the IOCs as the actionable part and the actor label as unknown until a second, independent telemetry source says otherwise.