Attackers deployed a previously undocumented .NET assembly-loading framework called NetamLoader against a custom Windows 10 build reserved for government entities in Asia, The Hacker News reported, citing research Kaspersky detailed this week. The framework gives attackers a way to retrieve and execute further payloads inside Windows processes, while deleting files and execution traces.
Kaspersky’s telemetry identified one victim in Asia. The activity has not been attributed to a known threat actor, and whether the intrusion extended beyond one system or resulted in sensitive information being stolen remains unclear.
The targeted country was not disclosed. The Hacker News suggested China as a likely possibility because Microsoft offers Windows 10 China Government Edition for Chinese government and state-owned entities; that is the publication’s inference, rather than a confirmed victim identification.
An update-directory archive starts the chain
Kaspersky detected the artifact in the first half of 2026 inside a Windows cabinet archive, or CAB file, stored in a directory used for operating system update packages:
C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24
The archive’s contents were extracted into C:\Windows\SoftwareDistribution\Download\Install\. Its delivery method remains unknown. A supply chain compromise involving a trusted third-party vendor is suspected, rather than established.
The CAB contained seven files: fabric.config, Microsoft.HostIntegration.Connectors.dll, PatchMyPC-Enum.dll, PatchMyPC-Models.dll, PatchMyPC-ScriptRunner.exe, PatchMyPC-ScriptRunner.exe.config and Resources.resx. Four were legitimate components of Patch My PC, an endpoint management product. Only Resources.resx embedded malicious code.
Execution began with PatchMyPC-ScriptRunner.exe. The chain abused AppDomainManager injection, which hijacks the .NET Framework mechanism responsible for initializing application domains when an application starts. Like DLL sideloading, it allows malicious code to run within a legitimate application’s process.
In this case, the executable parsed PatchMyPC-ScriptRunner.exe.config, causing Microsoft.HostIntegration.Connectors.dll to execute. That component located and parsed the adjacent fabric.config, then loaded Resources.resx.
The resource file held multiple layers of encoded, compressed or encrypted content, including XAML files, .NET assemblies and JSON data. Each component decoded and loaded the next, moving execution through a two-stage chain.
Layered payloads bypass scanning and remove traces
The first XAML loader, labeled XAML-1 by the researchers, loaded an embedded payload called XAML-2. That payload initialized the second stage by loading two compressed, Base64-encoded XAML files: XAML-2-1 and XAML-2-2. XAML-2-1 supplied an Antimalware Scan Interface, or AMSI, bypass.
XAML-2-2 contained a .NET module called .NET 1 Loader and a JSON payload called JSON-1. The JSON data split into two components: JSON-1-c stored command-and-control configuration, while JSON-1-p held a Base64-encoded assembly called .NET 2 Plugin and compressed, encrypted XAML templates used to construct XAML-3.
After XAML-2-2 loaded .NET 1 Loader, that module decrypted, assembled and loaded XAML-3. It also reported status to the command-and-control server and removed malicious files extracted from the CAB archive, CLR usage logs and Windows Prefetch cache files to conceal traces of execution.
XAML-3 ran within dllhost.exe, where it decoded, decompressed and loaded .NET 2 Plugin. The plugin loaded its command-and-control configuration, gathered system information from the Windows Registry and checked whether its current host process was dllhost.exe.
A government-specific target and delayed communications
The targeting centers on a government-only Windows build. In related policy context, The Hacker News cited an August Bloomberg report that China’s Ministry of State Security had ordered some government agencies to replace Windows “Government Edition” with Chinese-made Linux distributions to reduce dependence on foreign technology. Bloomberg attributed the instruction to data security concerns, citing people familiar with the matter.
Kaspersky’s broader assessment was that countries developing their own operating systems and other core platforms gain control over development, operation and upgrades, but also assume responsibility for protecting the surrounding ecosystem. Bringing its operation and maintenance to maturity takes time, the company said.
For practitioners examining this chain, the documented communications behavior includes substantial delays. In the sample detected during the first half of 2026, .NET 2 Plugin waited a random 20–40 minutes before making its first request to openaigpt4v[.]com. It then periodically fetched a XAML file and executed it in an isolated AppDomain.
A valid command-and-control response triggered a pause of 5–6 minutes before the next request. Otherwise, the plugin waited 22–28 hours, checking every 10 minutes whether that interval had elapsed.
