Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

The malware, labeled NetamLoader, was discovered in the first half of 2026 when Kaspersky Security Network (KSN) issued a malware detection alert for a .config file using AppDomainManager injection to load arbitrary .NET assemblies. The file was packaged inside a CAB archive placed in the Windows update directory, initially appearing to contain legitimate components of the Patch My PC tool.

Initial analysis found no obvious malicious code, as even the .NET assemblies used for injection were Microsoft-signed. A closer examination of the full loading process later revealed the complex infection chain and framework designed to target a custom Windows build used exclusively by government entities in Asia.

Infection Chain

The infection begins with the execution of PatchMyPC-ScriptRunner.exe, which serves as a host process. The accompanying configuration file PatchMyPC-ScriptRunner.exe.config loads before the executable's main function runs, directing it to load a Microsoft-signed assembly (Microsoft.HostIntegration.Connectors.dll).

This assembly then attempts to read a configuration file (fabric.config) in the same directory, which contains a className attribute that loads System.Resources.ResXResourceSet from the System.Windows.Forms assembly. The Resources.resx file contains multiple layers of payloads encoded, compressed, or encrypted, with each layer unpacking and loading the next.

Bypassing Security

The malware uses a TypeConfuseDelegate attack to invoke XamlReader.Parse(), loading a XAML payload that generates an AES key from the command line. This key decrypts additional XAML code, which initiates the second stage of infection.

In stage 2, the malware loads two additional XAML files after decoding and decompressing them. The first file (XAML-2-1) hijacks the Antimalware Scan Interface (AMSI) by patching its Scan method to always return 'clean' results, effectively bypassing security scanning.

The AMSI patch works by creating a delegate for Console.Clear(), obtaining its native function pointer, and overwriting the AMSI Scan method's first bytes in memory. This modification allows the malware to pass code integrity checks while disabling malware detection.

Detection and Attribution

Kaspersky's products detect this threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast., and Trojan.Script.Agent.. At present, no attribution to any known APT group has been established for this sophisticated attack chain targeting government systems.

The complex multi-stage infection mechanism, use of legitimate Microsoft-signed components, and advanced AMSI bypass techniques indicate a highly sophisticated actor with significant resources and knowledge of Windows internals and .NET framework vulnerabilities.