{"id":3914,"date":"2026-11-01T11:50:46","date_gmt":"2026-11-01T11:50:46","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3914"},"modified":"2026-11-01T11:50:46","modified_gmt":"2026-11-01T11:50:46","slug":"netamloader-malware-targets-government-windows-10-systems-in-asia-via-net-injection","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3914","title":{"rendered":"NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 01, 2026<\/span><\/span>Windows Security \/ Cyber Espionage<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of what has been described as a \u00abhighly sophisticated infection chain\u00bb targeting government organizations in Asia.<\/p>\n

The activity, detailed<\/a> by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed NetamLoader<\/strong>.<\/p>\n

The attack has not been attributed to any known threat actor or group. Nor is it clear if the intrusion compromised more than one system and allowed the hackers to steal any sensitive information.<\/p>\n

The Russian cybersecurity company said the artifact was detected in the first half of 2026, packaged inside a Windows cabinet archive (CAB) file placed in a directory that stores Windows operating system update packages.<\/p>\n

It’s suspected the operation involved a supply chain attack<\/a>, in which bad actors compromised a trusted third-party vendor to gain access to downstream users who rely on its services or software.<\/p>\n

The sample in question features a \u00ab.config\u00bb file that employs AppDomainManager injection<\/a> to load arbitrary .NET assemblies. AppDomainManager injection is an adversarial technique<\/a> used to load arbitrary payloads by hijacking .NET Framework’s AppDomainManager mechanism when a .NET application starts.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Put differently, the approach targets .NET Framework’s application-domain initialization to achieve code execution. The end result is the same as DLL sideloading: to run malicious code inside a legitimate application’s process so as to fly under the radar.<\/p>\n

According to Kaspersky, the CAB archive containing the .config file was placed in the path: \u00abC:\\Windows\\SoftwareDistribution\\Download\\e4537a1762fcafd2fd96bfc825bad34f9db9a24,\u00bb with its contents extracted and dropped into \u00abC:\\Windows\\SoftwareDistribution\\Download\\Install\\.\u00bb<\/p>\n\n\n\n\n
\"\"<\/a><\/td>\n<\/tr>\n
Infection chain: Stage 1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The exact delivery vehicle for the CAB archive remains unknown. Present in the archive are seven files, four of which are legitimate components of Patch My PC, an endpoint management software –<\/p>\n

<\/p>\n