Actor Profile

NetamLoader is a previously undocumented .NET assembly-loading framework disclosed by Kaspersky in November 2026. The malware has not been attributed to any known threat actor or group. The operation appears motivated by cyber espionage against government entities, specifically targeting custom Windows 10 builds used exclusively by government organizations in Asia. The attack likely involved a supply chain compromise, with the malware packaged inside a Windows cabinet archive (CAB) file placed in directories storing Windows OS update packages. The origin and identity of the threat actor remain unknown, though the sophistication and targeting suggest a state-sponsored or advanced persistent threat capability.

TTPs (Tactics, Techniques, Procedures)

The attack employs a highly sophisticated two-stage infection chain. Initial access likely occurred via supply chain attack (T1195.002), with the CAB archive delivered through compromised update mechanisms. The malware leverages AppDomainManager injection to achieve code execution (T1055), hijacking .NET Framework's application-domain initialization mechanism. Stage 1 abuses legitimate Patch My PC software components for execution (T1218), parsing configuration files to load malicious DLLs. Stage 2 deploys multiple encoded/compressed payloads including XAML files and .NET assemblies, implements AMSI bypass (T1562.001) for defense evasion, and establishes C2 communication with openaigpt4v[.]com using periodic polling with jitter delays (T1071.001). The malware performs system information discovery via Windows Registry queries (T1082), deletes malicious files, CLR logs, and Prefetch cache to cover tracks (T1070.004), and executes payloads in isolated AppDomains within dllhost.exe for stealth.

Targets & Patterns

NetamLoader specifically targets government organizations in Asia using custom Windows 10 builds designed exclusively for government use. Kaspersky telemetry identified a single victim in Asia, with strong indicators pointing to China as the likely target country. The malware was engineered to attack Windows 10 China Government Edition, a bespoke version Microsoft offers specifically for the Chinese government and state-owned entities. This highly targeted approach suggests the threat actor conducted reconnaissance to understand the victim's specific operating environment. The timing is notable: in August 2026, China's Ministry of State Security ordered some agencies to stop using the Government Edition in favor of Chinese-made Linux distributions due to data security concerns, potentially indicating awareness of compromise or vulnerability. The targeting pattern indicates espionage objectives focused on sensitive government information and operations.

Historical Context

NetamLoader was first detected in the first half of 2026 and disclosed by Kaspersky in November 2026. This represents the first public documentation of this .NET assembly-loading framework. No previous campaigns or related activity have been linked to this malware family. The attack's timing coincides with China's August 2026 directive to government agencies to migrate away from Windows 10 Government Edition to Chinese-made Linux distributions, suggesting possible awareness of security concerns or active exploitation. The sophisticated supply chain attack methodology aligns with broader trends in state-sponsored cyber espionage, though no attribution to known APT groups has been established. The geopolitical context reflects increasing efforts by countries to develop indigenous software platforms and reduce dependence on foreign technology.

Defensive Recommendations

  • Monitor for AppDomainManager injection attempts (T1055) by detecting unusual .config files in .NET application directories and unexpected AppDomainManager class loading via CLR ETW events
  • Implement file integrity monitoring on Windows update directories, specifically C:\Windows\SoftwareDistribution\Download\ paths, to detect unauthorized CAB archives or file modifications indicative of supply chain compromise
  • Deploy AMSI-based detection for .NET assembly loading and XAML payload execution, monitoring for AMSI bypass attempts (T1562.001) through Event Tracing for Windows (ETW) and PowerShell logging
  • Establish network monitoring for C2 communication patterns featuring periodic polling with long jitter delays (20-40 minutes initial, 5-6 minutes between requests, or 22-28 hour fallback intervals) and investigate connections to suspicious domains mimicking legitimate services
  • Detect defense evasion activities (T1070.004) by monitoring for bulk deletion of Prefetch files (C:\Windows\Prefetch\), CLR usage logs, and recently extracted files from SoftwareDistribution directories, especially when performed by dllhost.exe or legitimate software processes

---

# Geopolitical Context

Geopolitical Context

The disclosure of NetamLoader represents a sophisticated espionage operation targeting bespoke government operating systems in Asia, likely China's Windows 10 Government Edition. The attack's technical complexity—involving AppDomainManager injection, multi-stage XAML loaders, and AMSI bypass—suggests a well-resourced actor with strategic intelligence objectives. The suspected supply chain compromise via Patch My PC components indicates adversary capability to infiltrate trusted software distribution channels. This incident occurs against a backdrop of heightened technology sovereignty concerns: China's Ministry of State Security reportedly ordered agencies to migrate from Windows Government Edition to domestic Linux distributions in August 2026, citing data security. The timing suggests either a catalyst for that policy shift or exploitation of systems prior to migration. The operation underscores persistent targeting of government-exclusive technology platforms and the strategic value of custom OS builds as intelligence collection vectors.

State Actor Alignment

No attribution has been published by Kaspersky or other sources. The operation's sophistication, targeting of government-exclusive infrastructure, and apparent supply chain compromise are consistent with advanced persistent threat (APT) activity typically associated with state-sponsored or state-aligned actors. The single identified victim and highly tailored malware—designed specifically for a custom government Windows 10 build—suggest strategic intelligence collection rather than financially motivated cybercrime. The target profile (Asian government entities, likely Chinese state organs) and operational security measures (jitter delays, extended polling intervals, forensic artifact deletion) align with espionage tradecraft. Without technical indicators linking NetamLoader to known threat groups, attribution remains speculative. The incident does not appear connected to publicly disclosed sanctions regimes or enforcement actions at this time.

Business Impacty pro region

This incident highlights vulnerabilities in Asia-Pacific government technology ecosystems, particularly where states deploy customized operating systems intended to enhance security through obscurity or localization. If the target is confirmed as China's Windows 10 Government Edition, the breach carries significant implications for Beijing's technology sovereignty strategy and may validate concerns driving migration to indigenous platforms. For regional allies and partners, the operation demonstrates adversary interest in and capability against government-specific software builds, suggesting similar customized platforms in Japan, South Korea, India, and Southeast Asian nations may face comparable threats. European governments operating bespoke OS variants (e.g., France's secure Linux distributions) should reassess supply chain integrity for third-party management tools. The suspected supply chain vector via endpoint management software raises broader concerns about trusted vendor ecosystems serving government clients globally. NATO and EU member states relying on specialized Windows builds for classified networks may review similar attack surfaces.

Forecast

If NetamLoader represents ongoing espionage infrastructure rather than a one-time operation, additional victims using government-customized operating systems in Asia may emerge as threat intelligence sharing improves. If the suspected supply chain compromise via Patch My PC or similar endpoint management tools is confirmed, vendors serving government clients globally are likely to face increased scrutiny and security audits from procurement authorities. If China's reported migration from Windows Government Edition to domestic Linux accelerates in response to this or related incidents, Microsoft's presence in Chinese government IT infrastructure will likely diminish further, potentially creating new opportunities for indigenous software providers but also introducing risks associated with less mature security ecosystems. If the threat actor behind NetamLoader remains unidentified, defenders should anticipate potential reuse of the AppDomainManager injection and XAML-based loading techniques against other .NET-dependent government systems. If geopolitical tensions in the Asia-Pacific continue to drive technology decoupling, the number of proprietary government OS platforms—and corresponding espionage operations targeting them—is likely to increase.