Kaspersky says NetamLoader malware targets a government only Windows 10 in Asia; how it arrived is unknown

One payload file in seven, and nobody saw the package arrive

Kaspersky's report on NetamLoader shows the package it found as a CAB archive of seven files. The sizes in its own screenshot add up to 5,971,803 bytes (derived), and the file that carries the payload, Resources.resx, is 205,263 of them: 3.4 percent (derived). The rest is a Patch My PC update runner, two Patch My PC libraries, a library Kaspersky says is Microsoft signed, and two short configuration files. Kaspersky says that apart from Resources.resx none of the seven files contains malicious code, and that its first look at the CAB found nothing malicious for that reason. Our inference, not Kaspersky's: a check that judges the executables by their signature or their vendor would have passed this package.

That is the finding that matters to a defender, and it comes with a long list of things the report does not establish. Kaspersky says it did not observe how the CAB reached the machine. It does not name the country or the agency. It saw one victim in its telemetry, and it says it could not link the activity to any known APT group. The word "supply chain" in its introduction is a conclusion drawn from the shape of the package, not a delivery step anyone watched.

This briefing rests on Kaspersky's report on Securelist, dated 29 October 2026, which we read in full including the indicators section, between 13:56 and 14:10 GMT on Friday 30 October 2026. The Record's article of 30 October 2026 is the pointer to it, and where the two differ this briefing follows the report. Kaspersky, which The Record calls a Russian cybersecurity firm, sells detection, and the report lists its own detection names, so the interest is plain. The technical description is checkable against the indicators it prints; the inferences about who and why are not.

Zoom

The screenshot also carries modified dates. Six files show 3 April 2025 and Resources.resx shows 17 December 2025, 258 days later (derived). File dates are easy to set and Kaspersky draws no conclusion from them, so they do not show when the payload was built. They do show that the one file with the payload is the one that differs from the rest of the package.

The chain, step by step, and which part is legitimate

Kaspersky describes a two stage loading mechanism with multiple steps, and every program file that runs in stage 1 is one of the legitimate files in the package. The CAB is placed in the folder that holds Windows update packages and its seven files are extracted to a subfolder named Install. What Kaspersky saw was the runner process, PatchMyPC-ScriptRunner.exe, started with an update package argument. From there the chain uses behaviour that .NET and Windows document, in this order.

The last row is the one to remember. The key comes from the command line of the host process, so a sandbox that replays the files without the exact arguments gets a silent exit, not a behaviour to observe. That is our reading of Kaspersky's description of the key derivation, and Kaspersky itself says the silent exit is there so that no error message reveals the attack.

Zoom

Zoom

The technique has a public name. MITRE ATT&CK describes AppDomainManager injection as sub technique T1574.014, in which a .config file or environment variable makes an otherwise benign .NET program load a chosen assembly, and its page (version 2.0, last modified 12 May 2026) lists a detection strategy built on config file tampering and unusual assembly loads. Kaspersky does not cite ATT&CK in the report text we read; the link is ours. Microsoft's guide says of BinaryFormatter that it "is insecure and can't be made secure" and that, from .NET 9, the in box implementation throws. The config file Kaspersky prints asks for .NET Framework 4.x, so that change does not obviously help here (our reading, not Kaspersky's).

Stage 2: patch the scanner, erase the traces, wait

XAML-2 unpacks two more XAML files. The first, 796 lines long, hijacks a key AMSI function so that the Windows anti malware scan interface stops reporting detections in that process; Kaspersky says every scan then returns a clean result, and that the strings are cut into tiny pieces to dodge signature scans. The second holds the first .NET loader and a configuration file for the command and control server, called the C2 server in the report.

The loader then cleans up before anything else. It deletes the three files extracted from the CAB, the CLR usage log for the runner and the Prefetch cache entries for it. It rewrites the log files under a folder named CmitUpdateAgent, removing every line that contains the substring GetExtendedUpdateInfoHandler. It deletes registry keys it uses as an exception state log, and it requires an administrator, otherwise it fails with error code 128. Kaspersky notes that the CmitUpdateAgent path "may be linked" to a custom Windows 10 build used by a government in Asia. That is the only direct evidence the report offers for the build itself.

Next it sets the environment variable COMPlus_ETWEnabled to 0 so the .NET runtime does not register its event tracing provider, then uses an RPC call to a COM object to load the third XAML payload inside dllhost.exe. Kaspersky says this separates the infection from the original process and gets around behaviour monitoring such as EDR. The final component, the .NET 2 Plugin, writes a DllSurrogate registry value, holds its object so that dllhost.exe stays alive, and begins to wait.

Zoom

Zoom

Everything the malware does on the network is wrapped in HTTPS, and inside that it encrypts and authenticates with AES 128 in CBC mode plus an HMAC. The report prints the master key in its configuration listing. This briefing does not reproduce it. The report does not describe any payload the C2 server sent back. It says the plugin runs any XAML it downloads in a short lived AppDomain and then unloads it, which means what the operators did on the machine, if anything, is not in the report.

One machine, one detection, and the dates that are given

The report gives a first half of 2026 date for the sample: Kaspersky Security Network (KSN), the source of the telemetry the report cites, raised an alert on a .config file that used AppDomainManager injection to load arbitrary .NET assemblies. That is the whole detection story. The CAB sat in C:\Windows\SoftwareDistribution\Download under a 40 character name that is the same hexadecimal string the report uses in its first indicator line. Kaspersky says a later second look of the original .config and of the full loading process revealed the chain. The introduction says the research came "a couple of months ago", which does not give a date.

On victims, the report says that based on KSN telemetry it "identified a single victim in Asia", and that it also learned the malware was designed to target a specially customised government only version of Windows. It then infers that the victims are Asian government entities. How it learned the government only point is not stated. The Record writes that Kaspersky detected the malware on one computer, which agrees.

One date is for infrastructure. The report's table gives the C2 domain's first seen date as 27 September 2023, 1,128 days before the report (derived). A first seen date is not proof of use, and the report does not say the domain was used in any earlier campaign. The report says the C2 address is part of Cloudflare's CDN and the domain is registered with Cloudflare, and its table pairs it with the number 15169 as the ASN; this briefing prints that cell as the report does and has not checked it.

What the report says about the supply chain and the actor

The report title calls the actor an unknown APT, and its attribution section is one sentence: after analysing techniques, code similarities and infrastructure, Kaspersky was unable to link the attack to any known APT group. The Record's article opens by calling them suspected nation state hackers and says Kaspersky could not link the attack to any known state sponsored group. The report text we read does not use the words state sponsored; the claim of a state behind it is the news article's framing.

Zoom

Two sentences in The Record are not in the report text we read. One says researchers had not established whether the attackers stole sensitive information. The other says they could not confirm whether the software update infrastructure itself was compromised. Both are consistent with the report's silence, but they are the journalist's wording, and neither is a Kaspersky finding we can quote.

The conclusion is the report's own widest claim, and it is a policy argument rather than a finding. Kaspersky writes that countries building their own operating systems get full control of development and upgrades but must also protect the entire ecosystem alone, and that until a system matures it and its emerging supply chain could be exposed to attacks through several routes. That is a reasonable caution. It is not evidence about this incident, which rests on one machine.

Four friendly names that do the work of a control

Signed. A valid Microsoft signature on a library says who built that library. It does not say what a configuration file next to a program told the runtime to load with it. In this chain the signed library is the stepping stone, and Kaspersky calls the way it reads fabric.config a design flaw.

The update folder. Packages under SoftwareDistribution are assumed to be updates. A CAB placed there and run by a vendor's own update runner inherits that assumption, and Kaspersky's account is that nothing in the package looked malicious until the config was read together with the rest.

Patch My PC. The name in a process list reads as routine software maintenance. The report treats the Patch My PC components as legitimate files used as a host and does not claim the vendor was compromised, which is exactly why a defender cannot treat the name as a verdict either way.

The domain. The C2 domain is openaigpt4v[.]com and the request path is /model_v4/. In a proxy log that can read like traffic to an AI model service (our inference). The report does not connect the domain to any AI company, and OpenAI is not a party to anything in it. The point for a defender is only that a name which sounds like a sanctioned service is not a reason to skip a look at the destination.

What to do, in the order worth doing

Technical details

These are the artifacts Kaspersky's report prints, copied as printed, with the source and the date read in each caption. The report is the only primary source; MITRE and Microsoft are cited above for the technique and for BinaryFormatter, and print none of these. Live infrastructure is defanged as the report defanged it. This site leaves out the AES master key and the other embedded keys and encoded blobs the report shows, and no exploit code is included. Hunt for the file names and registry values on the host, and for the domain at the proxy; the hash values only match this one sample.

Detection names. The three names Kaspersky says its products use. A defender on another product can use them only as a pointer to what Kaspersky grouped together.

HEUR:Trojan.MSIL.NetamLoader.gen
Trojan.MSIL.Zapchast.*
Trojan.Script.Agent.*

Where the package sat and how it was launched. The CAB archive was a file with no extension in the update download folder, and its contents were extracted to an Install subfolder. The second line is the process command line Kaspersky observed, with the application identifier masked in the report. Look for this folder tree and for the runner started this way.

C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24d

C:\Windows\SoftwareDistribution\Download\Install\PatchMyPC-ScriptRunner.exe -updatepackage -applicationid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The file that points a legitimate runner at attacker content. This is the whole of the configuration file Kaspersky prints. It is read by the .NET runtime before the program starts. A defender can search for config files of this shape beside any vendor executable. It names a Microsoft signed class and assembly.

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
	<runtime>
		<appDomainManagerType  value="Microsoft.ApplicationServer.Caching.DataCacheFactoryConfiguration">
       </appDomainManagerType>
		<appDomainManagerAssembly  value="Microsoft.HostIntegration.Connectors, Version=1.0.0.0, 
                    Culture=neutral, PublicKeyToken=31bf3856ad364e35">
       </appDomainManagerAssembly>
		<NGenAssemblyUsageLog enabled="0" />
	</runtime>
    <startup> 
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6" />
    </startup>
</configuration>

The second configuration file. The library named above reads this file from its own folder. It names the resource set class and the resx file. Note the class name and a file name inside the type string.

<?xml version="1.0" encoding="utf-8"?>
<section name="foo">
    <customType className="System.Resources.ResXResourceSet, System.Windows.Forms, 
                Version=4.0.0.0, Culture=neutral, 
                PublicKeyToken=b77a5c561934e089(Resources.resx)" />
</section>

What the loader deletes and edits. These are the paths and the one string the report says the loader removes. They are where a defender looks for gaps and for log lines that are missing. The question marks are the report's own wildcards.

PatchMyPC-ScriptRunner.exe.config
fabric.config
Resources.resx

%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\PatchMyPC-ScriptRunner.exe.log
%WINDIR%\Prefetch\PATCHMYPC-SCRIPTRUNNER.EXE-*.pf

"%WINDIR%\Logs\CmitUpdateAgent\20????\20??????"
GetExtendedUpdateInfoHandler

Registry values and identifiers. The first two paths are read for system information. The SusClientId value under the WindowsUpdate key is read and used to build a machine identifier. The appid path with the DllSurrogate value is what the plugin creates. The three class identifiers are the COM objects the report names for the AMSI hijack, for the script shell and for the remote object that runs stage 3.

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full", Key="Version"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion", Key="BuildLab"

"LocalMachine\SOFTWARE\Classes\appid\{ff259bcd-2f0a-44de-b34a-0092fec1d8a2}
DllSurrogate = ""

AMSI COM object: fdb00e52-a214-4aa1-8fba-4357bb0072ec
WScript.Shell: 41904400-BE18-11D3-A28B-00104BD35090
Remote COM object: ab8902b4-09ca-4bb6-b78d-a8f59079a8d5
Environment variable set to 0: COMPlus_ETWEnabled

The AMSI patch. The report prints the ten bytes it writes over the start of the Console.Clear method and says the pointer to the AMSI scan function in the object's virtual method table is then changed to point at it. A memory scanner can look for the byte sequence; a defender without one can note that the host process is .NET and the AMSI provider's table was altered in memory.

41 C7 00 01 00 00 00 33 C0 C3

The command and control address and the request shape. The report prints the domain and one full request URL, with the encrypted query value. The path ends in a per instance identifier. This site shortened the encrypted value, marked in brackets. The third block is the infrastructure table as printed, including the ASN cell, which this site has not checked.

https://openaigpt4v[.]com/model_v4/94aafd58-c00c-402a-aae6-858b4486a1a4?b=lM4V3VwrWtXBy4oBGUkXOHfxyLUlrT2hIZGn4C37W1Z3%2FeW1WURJqzaNLQhGFHsWxA2l[shortened by this site]&c=41bd7f37-c3f6-4a9e-b2f3-5363e9a2c095

Domain: openaigpt4v[.]com
IP: 104.18.14[.]219
First seen: Sep 27, 2023
Domain Registrar/ASN: Cloudflare, Inc. / 15169

File hashes. The report lists these 32 character values beside names, without naming the algorithm. Their length matches MD5, which is our reading (derived). The first line is the CAB archive, shown under its file name. Match them against file inventories; they cover this one sample and its extracted layers.

F2458ED133F8D0CA19E22C10F577E98E    e4537a1762fcafd2fd96bfc825bad34f9db9a24d
E1DC6F1ED193594F2284BE22AE08DFA4    Resources.resx
AB81564BCB8CA7E710C66832DE747556    .NET 1 Loader
CFB8B281BDF5D9390E64B10C312FB2C1    .NET 2 Plugin
67E3617F8709D34F806F8E02BADBA8A5    fabric.config
514AC0D73B8A1B73488EF5E2E55A75C3    PatchMyPC-ScriptRunner.exe.config
514117D536E347560D049CFE0C609632    XAML-1
9000820D8153C24CD60D53001D3A97B6    XAML-2
B3C4A635179680EDAFB5D006CF0CFFC6    XAML-2-1
4F28622C5E60C01319BF48CF742FE1A5    XAML-2-2
C86D53392A87DD3F3E62D62C9B92A9BD    XAML-3

Paths in the indicator list. The report's file path list holds three paths, all in the Install subfolder, which repeat the files named above.

C:\Windows\SoftwareDistribution\Download\Install\PatchMyPC-ScriptRunner.exe.config
C:\Windows\SoftwareDistribution\Download\Install\fabric.config
C:\Windows\SoftwareDistribution\Download\Install\Resources.resx

What the report does not print. It prints no detection rule, no YARA or Sigma content, no network signature and no sample of a downloaded second stage. The hunting ideas above are this site's reading of the behaviour, not content from the report.

The question this leaves

Kaspersky found one machine because a cloud alert fired on one configuration file. The malware deletes its own traces, delays its first call for up to 40 minutes, and waits up to 28 hours between calls. So ask your own team one question about any customised or locked down Windows build you run. If a signed vendor program in your update folder were pointed at something else by a config file that arrived in an update package, which control would notice, and who would see it? If the honest answer is that the package would pass every check because every executable in it is legitimate, then the exposure is not a single sample. It is that the update path itself is trusted more than anything that arrives through it.

Key facts