Cybersecurity researchers have disclosed details of what has been described as a “highly sophisticated infection chain” targeting government organizations in Asia.
The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed NetamLoader.
The attack has not been attributed to any known threat actor or group. Nor is it clear if the intrusion compromised more than one system and allowed the hackers to steal any sensitive information.
The Russian cybersecurity company said the artifact
The Russian cybersecurity company said the artifact was detected in the first half of 2026, packaged inside a Windows cabinet archive (CAB) file placed in a directory that stores Windows operating system update packages.
It’s suspected the operation involved a supply chain attack, in which bad actors compromised a trusted third-party vendor to gain access to downstream users who rely on its services or software.
The sample in question features a “.config” file that employs AppDomainManager injection to load arbitrary .NET assemblies. AppDomainManager injection is an adversarial technique used to load arbitrary payloads by hijacking .NET Framework’s AppDomainManager mechanism when a .NET application starts.
Put differently, the approach targets .NET Framework’s application-domain
Put differently, the approach targets .NET Framework’s application-domain initialization to achieve code execution. The end result is the same as DLL sideloading: to run malicious code inside a legitimate application’s process so as to fly under the radar.
According to Kaspersky, the CAB archive containing the .config file was placed in the path: “C:WindowsSoftwareDistributionDownloade4537a1762fcafd2fd96bfc825bad34f9db9a24,” with its contents extracted and dropped into “C:WindowsSoftwareDistributionDownloadInstall.”
 |
| Infection chain: Stage 1 |
The exact delivery vehicle for the CAB archive remains unknown. Present in the archive are seven files, four of which are legitimate components of Patch My PC, an endpoint management software –
- fabric.config
- Microsoft.HostIntegration.Connectors.dll
- PatchMyPC-Enum.dll
- PatchMyPC-Models.dll
- PatchMyPC-ScriptRunner.exe
- PatchMyPC-ScriptRunner.exe.config
- Resources.resx
None of the files with the exception of “Reas a two-stage process as follows –
- The execution of “PatchMyPC-ScriptRunner.exe” serves as the launchpad for several payloads. It abuses AppDomainManager injection to parse “PatchMyPC-ScriptRunner.exe.config,” resulting in the execution of “Microsoft.HostIntegration.Connectors.dll.”
- Once loaded, “Microsoft.HostIntegration.Connectors.dll” finds “fabric.config” located in the same directory and parses its contents to load “Resources.resx.”
- “Resources.resx” contains “multiple layers” of encoded, compressed, or encrypted payloads, such as XAML files, .NET assemblies, and JSON data, which are decoded and loaded by the component before it.
 |
| Infection chain: Stage 2 |
A brief description of these payloads is listed below –
- XAML-1, a loader for an embedded payload, XAML-2.
- XAML‑2 initializes the second stage of the attack chain by loading two compressed and Base64‑encoded XAML files: XAML-2-1 and XAML-2-2. XAML-2-1 is used to bypass Antimalware Scan Interface (AMSI).
- XAML-2-2 contains two parts, a .NET module (aka.NET 1 Loader) and a JSON data payload (aka JSON-1).
- JSON-1, the JSON payload that contains two components: JSON-1-c, which stores command-and-control (C2) server configuration, and JSON-1-p, which contains a Base64‑encoded file (.NET 2 Plugin) and a collection of compressed, encrypted XAML templates used to build XAML-3.
- XAML-2-2 loads .NET 1 Loader, which then serves as a decrypting, assembling, and loading for XAML‑3, reports the status to the C2 server, and deletes malicious files extracted from the CAB archive, along with CLR usage logs and Windows system Prefetch cache files to cover up the tracks.
- XAML-3, the XAML payload that runs within “dllhost.exe” and is designed to decode, decompress, and load .NET 2 Plugin.
- .NET 2 Plugin, a .NET assembly that loads the C2 configuration, gathers system information from Windows Registry, checks if the current host process is “dllhost.exe,” waits a random jitter delay of 20-40 minutes before issuing its first request to the C2 server (“openaigpt4v[.]com”), and enters into a periodic polling loop to fetch an XAML file and execute it in an isolated AppDomain.
If a valid response is received from C2,
“If a valid response is received from C2, the loop pauses for 5-6 minutes before the next request; otherwise, it pauses for 22-28 hours, checking every 10 minutes to determine whether the allotted time has elapsed,” Kaspersky explained.
Telemetry data gathered by Kaspersky has identified a single victim in Asia, with NetamLoader designed to attack a Windows 10 build customized for government-only use. Although the targeted Asian country was not disclosed, signs are that it’s likely China, as Microsoft offers a bespoke version called Windows 10 China Government Edition specifically for the Chinese government and state-owned entities.
Earlier this August, Bloomberg reported that China’s Ministry of State Security had ordered some government agencies to stop using the “Government Edition” in favor of Chinese-made Linux distributions as part of an effort to reduce its dependence on foreign technology.
Beijing’s instruction stemmed from data security concerns, Bloomberg
“Beijing’s instruction stemmed from data security concerns,” Bloomberg said, citing “people familiar with the matter.” No additional details were disclosed at the time.
“In today’s geopolitical climate, a growing number of countries are building their own core software platforms, including operating systems, databases, middleware, and cloud services, with operating systems often the top priority,” Kaspersky concluded.
“The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process. On the other hand, it also means that each country must protect this entire vast ecosystem on its own. Bringing the operation and maintenance of such a system to maturity is a lengthy process.”
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
