Researchers have uncovered a sophisticated malware campaign striking government systems in Asia. Dubbed “NetamLoader,” the threat is designed to infiltrate a custom Windows 10 build used exclusively by government entities, leveraging a previously undocumented .NET assembly‐loading framework. Infections were detected during the first half of 2026 through samples packaged in Windows cabinet (CAB) files stored within system update directories. The exact perpetrator remains unidentified.
Attack Vector & Infection Chain
The malware appears to stem from a potential supply chain compromise. Bad actors reportedly slipped a malicious CAB archive into a trusted update package vendor, letting it access government systems downstream. The CAB file was placed in the C:\Windows\SoftwareDistribution\Download folder, then its contents extracted into …\Download\Install\—directories integral to Windows update processes.
Inside the archive were seven files—four legitimate DLLs tied to the Patch My PC endpoint manager, plus a ScriptRunner executable and its config, along with a resource file. The attack’s entry point is the ScriptRunner executable which, via an AppDomainManager injection enabled by its config file, loads a DLL that processes the resource file. That file in turn houses layers of encoded, compressed or encrypted payloads—XAML files, .NET assemblies, JSON data—unfolding in stages.
Payloads, Evasion & Command-and-Control
Stage two includes a loader embedded as XAML files: one set bypasses the Antimalware Scan Interface (AMSI), another loads a JSON data payload. That JSON contains configuration pointing back to a C2 server and a plugin packed as a secondary .NET assembly. These components work together to orchestrate the attack: decrypting, assembling, and executing further payloads; launching code inside dllhost.exe; gathering system info; and waiting 20-40 minutes before connecting to a command server at a domain mimicking “openaigpt4v[.]com.”
The malware cycles through polling intervals—if it receives valid instructions, it polls every 5-6 minutes; otherwise it waits 22-28 hours, checking briefly every 10 minutes. Along the way it cleans up artifacts like extracted files, runtime logs, and prefetch cache data to reduce detection risk.
Target, Attribution & Implications
Only one confirmed victim was identified, in Asia, and the targeted system appears to be a Windows‐10 version tailor‐made for government use. While the country wasn’t named, evidence points toward China, especially with Microsoft offering a “Windows 10 China Government Edition” deployed in official channels. Earlier this year, Beijing reportedly told agencies to move away from that version toward domestic Linux alternatives amid concerns over foreign software dependencies.
As nations increasingly build their own core software—operating systems, databases, cloud platforms—such bespoke platforms become both strategic assets and soft targets. If well defended, they offer control and independence; if compromised, the fallout is deeply risky.
NetamLoader’s complexity—multi-stage loaders, advanced evasion, exploitation of legit software components—demonstrates the evolving sophistication of state-level cyber espionage. Governments must now ask: how robust are their trusted supply chains, and can their bespoke environments resist such tailored threats?
