A previously unseen malware framework named NetamLoader is targeting custom builds of Windows 10 used exclusively by several Asian governments. Security researchers have not yet tied it to any known threat actor. What sets this campaign apart is its apparent supply-chain nature and the stealth tactics baked into its deployment.
How NetamLoader’s Infection Chain Works
Discovered by analysts at Securelist, part of a leading cybersecurity firm’s GReAT team, NetamLoader was first detected in early 2026 via telemetry showing a suspicious configuration file hidden inside a CAB archive stored in Windows’ update package directory. Only one file within the archive, “Resources.resx,” carried malicious code, while the rest appeared to be legitimate parts of a third-party patch tool, and even some .NET modules carried valid Microsoft digital signatures.
The malware chain kicks off when a component styled as ScriptRunner (from PatchMyPC) executes. It leverages AppDomainManager injection within a config file to run code before the program’s main logic begins. A Microsoft-signed module named via a “fabric.config” points Windows to “Resources.resx,” which uses an older, vulnerable BinaryFormatter flaw to execute hidden code embedded in a XAML script. Hidden layers—some encoded, compressed, or encrypted—are unwrapped using a key pulled from the command line of the launcher. If an automated environment like a sandbox is detected, the chain aborts to avoid exposure.
Persistence, Evasion, and C2 Communication
After the early stages succeed, NetamLoader deploys a second stage that disables protections by patching Windows AMSI (Antimalware Scan Interface), ensuring that scans return “clean” results. It then eradicates traces of its activities by deleting extracted payloads, .NET logs, Prefetch files, and even modifying update logs specifically in a folder believed to be custom to the affected government OS.
The final payload runs inside a Windows host process (dllhost.exe) launched via a remote COM object to avoid detection by endpoint detection and response (EDR) systems. The component dubbed the “.NET 2 Plugin” establishes contact with a command-and-control server at openaigpt4v[.]com. Its communication cadence is deliberately slow—initial contact delayed by 20‒40 minutes post-installation to evade sandbox analysis. Subsequent check-ins alternate between every 5‒6 minutes during active communication, and periods of 22‒28 hours with ten-minute polling intervals when no response is received. All traffic is encrypted with AES and authenticated via HMAC. The malware is also capable of surmounting network restrictions by discovering and using proxies.
Target, Detection & Defense
Only one confirmed victim has been linked to NetamLoader so far, and researchers believe the target is a government agency running a custom build of Windows 10. The attack appears designed specifically for OS builds that are tightly controlled within certain government infrastructure.
Detection signatures already used include identifiers like HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast., and Trojan.Script.Agent. Organizations are urged to closely monitor update folders for unexpected config files and even signed executables loading code in unusual ways. Also important is watching for strange background processes reaching external servers, absence of expected log entries, and ensuring off-site or centralized backups of logs before malware can wipe local traces.
Indicators of Compromise (IoCs) published include specific file hashes for TAR/archived CAB files, Resx payload containers, various XAML files, and the script runner executable and its config. Domains and IPs tied to the C2 server have also been revealed—note that domains are obfuscated in public reports to reduce risk of misuse.
Because the malware was built around a government-specific version of Windows, it implies that countries configuring their own OS environments need to own not just endpoint security, but full supply chain protection. Hardened update mechanisms, signed code integrity enforcement, and rigorous sandbox/behavioral testing will be critical going forward.
What this means: NetamLoader represents a leap in sophistication for supply-chain style attacks. Its use of trusted components, code signing, and elaborate bypasses for defensive tools make it especially dangerous for environments that assume in-house Windows builds are automatically more secure. Governments and large organizations using custom OS builds must review their software supply chains, ensure update channel integrity, and audit what counts as “trusted software.” This case shows attackers are already adapting to environments once thought safer by default—it’s time defenders do the same.
