Unknown APT Leverages NetamLoader for Sophisticated Supply Chain Attack on Asian Governments
A sophisticated .NET assembly-loading framework, dubbed NetamLoader, is being used by an unknown APT group in a suspected supply-chain attack targeting a custom Windows build used by government entities in Asia.
Security researchers have uncovered a highly sophisticated infection chain and a complex .NET assembly-loading framework, identified as NetamLoader, which strongly suggests a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia. At present, no attribution to any known Advanced Persistent Threat (APT) group has been established. The malware sample came to light in the first half of 2026 when Kaspersky Security Network (KSN) issued a malware detection alert for a .config file employing AppDomainManager injection to load arbitrary .NET assemblies. This file was found packaged within a CAB archive, strategically placed in the directory designated for Windows operating system update packages.
Initial analysis of the CAB archive revealed no overtly malicious code. The majority of the executables were legitimate components of the third-party patch management tool, Patch My PC. Even the .NET assemblies utilized for the injection process were signed by Microsoft, adding a layer of obfuscation. However, a subsequent re-examination of the original .config file and the complete loading process unveiled the intricate infection chain and the advanced loading framework detailed in this report. Kaspersky's security products detect this threat under various signatures, including HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*
The infection chain begins with the discovery of a CAB file, named e4537a1762fcafd2fd96bfc825bad34f9db9a24d, located in the C:\Windows\SoftwareDistribution\Download directory. This archive contains seven files, which are extracted to C:\Windows\SoftwareDistribution\Download\Install\. Among these, only Resources.resx is identified as potentially malicious, while other files like PatchMyPC-ScriptRunner.exe are legitimate components. The observed execution path involves PatchMyPC-ScriptRunner.exe running with specific command-line arguments related to an update package, indicating its role as a host process for the subsequent payloads.
The core of the attack lies in a complex two-stage loading mechanism. Stage 1 utilizes an AppDomainManager injection technique. When PatchMyPC-ScriptRunner.exe is executed, its accompanying configuration file, PatchMyPC-ScriptRunner.exe.config, is loaded. This configuration file specifies a custom appDomainManagerType and appDomainManagerAssembly, pointing to legitimate Microsoft assemblies like Microsoft.HostIntegration.Connectors.dll. This setup allows the malware to hijack the legitimate process's execution flow.
A critical design flaw within the DataCacheFactoryConfiguration class, loaded via the .config file, is exploited. This class, intended for Windows Server AppFabric Cache Client configuration, attempts to load a custom configuration file named fabric.config. This file is meticulously crafted to abuse the class's parsing mechanism. When fabric.config is processed, the className attribute is used to load an arbitrary .NET assembly, specifically System.Resources.ResXResourceSet from System.Windows.Forms.dll, and instantiate it with Resources.resx as an argument.
The Resources.resx file acts as a container for multiple layers of payloads, encoded, compressed, or encrypted using various methods, including XAML files, .NET assemblies, and JSON data. This file leverages the Microsoft RESX schema, which can store application resources. Crucially, it contains a Base64-encoded binary object serialized using the vulnerable .NET BinaryFormatter class. Deserializing this object triggers the execution of the embedded malicious code, initiating the subsequent stages of the attack chain.
The multi-layered payload delivery within the Resources.resx file ensures a robust and evasive infection process. Each layer is unpacked and loaded by the preceding one, creating a complex chain of execution that is difficult to detect. This sophisticated approach, combined with the use of legitimate system components and Microsoft-signed assemblies, highlights the advanced capabilities of the unknown threat actor behind NetamLoader. The targeting of custom Windows builds used by government entities in Asia indicates a strategic focus on high-value targets within the region.