NetamLoader Malware Targeted Government Windows 10 Systems in Asia
Summary
Kaspersky disclosed NetamLoader activity targeting a government-use Windows 10 build in Asia. Telemetry identified one victim; the delivery method and any data theft remain unknown, and the activity has not been attributed.
Key points
- Kaspersky detected the artifact in the first half of 2026 and identified one victim in Asia.
- The activity targeted a custom Windows 10 build used by government entities; China is suggested but not confirmed.
- NetamLoader is a previously undocumented .NET assembly-loading framework using AppDomainManager injection.
- A CAB archive was found in a Windows update-package directory; how it was delivered remains unknown.
- Kaspersky suspects a supply-chain operation, but the activity is unattributed and data theft is unclear.
Article Details
- Event Type
- Disclosure of a previously undocumented malware infection chain targeting government systems.
- Impact
- Kaspersky telemetry identified one victim in Asia, using a custom Windows 10 build for government entities. The source says the target country may be China, but it was not disclosed. Whether the intrusion affected additional systems or resulted in sensitive-data theft is unknown; a supply-chain attack is suspected.
Malware
Vendors
Products
.NET FrameworkAppDomainManager injection is an adversarial technique used to load arbitrary payloads by hijacking .NET Framework's AppDomainManager mechanism when a .NET application starts.Patch My PCThe exact delivery vehicle for the CAB archive remains unknown. Present in the archive are seven files, four of which are legitimate components of Patch My PC, an endpoint management software -Windows 10The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading frameworkWindows 10 China Government Editiondisclosed, signs are that it's likely China, as Microsoft offers a bespoke version called Windows 10 China Government Edition specifically for the Chinese government and state-owned entities.