NetamLoader: a government-only Windows build, a legitimate patch tool and a loader hidden in the update folder

Everything a signature check would see was legitimate

Kaspersky’s Global Research and Analysis Team has disclosed an intrusion against a customised Windows 10 build used exclusively by government organisations in an Asian country ^[1][2]. The researchers presented the work at the Security Analyst Summit in Bali on 29 October 2026 ^[2][5].

The implant is a previously unknown .NET framework Kaspersky calls NetamLoader ^[1]. It was not hidden in a malicious executable. It was hidden in configuration and resource files placed beside legitimate, signed software inside the Windows update download folder ^[1][4][5].

Kaspersky has one victim, identified through its own telemetry ^[1][2]. It has not linked the activity to any known group ^[1]. It names neither the country nor the agency ^[2][3].

What the research shows

Kaspersky’s telemetry flagged a suspicious .config file in the first half of 2026 ^[1][3]. The file sat in a CAB archive in C:\Windows\SoftwareDistribution\Download ^[5]. Most of the archive was legitimate. It contained components of Patch My PC, a third-party patch management tool, and Microsoft-signed .NET assemblies ^[1][2]. Initial review found no malicious code. A re-examination of the configuration and the full loading process exposed the chain ^[1].

At a defensive level, the chain works as follows ^[1][4][11].

• A Patch My PC executable runs with a modified configuration that abuses AppDomainManager, so a legitimate .NET host loads attacker-chosen code. MITRE tracks this as T1574.014 ^[7].
• A Microsoft-signed component reads a crafted resource file. Kaspersky describes the abuse of a known .NET BinaryFormatter weakness ^[1]. Microsoft’s own guidance says BinaryFormatter deserialisation is never safe with untrusted input ^[8].
• Several layers of encoded, compressed and encrypted XAML and .NET loaders unpack in turn. One decryption key is derived from the host process’s command line, so the payload will not decrypt if run with the wrong arguments ^[4][11].
• The loader patches the anti-malware scan interface so scans return clean, and sets an environment variable that stops the .NET runtime registering its event-tracing provider ^[1][4].
• It deletes extracted files, CLR usage logs, Prefetch entries and lines in update logs, and clears registry keys used for exception tracking ^[1][4].
• It moves the main payload into a new dllhost.exe process through COM, breaking the original process tree ^[1][4].

The command-and-control profile is built for patience. The loader waits 20 to 40 minutes before first contact ^[1][2]. With no valid response, it retries after 22 to 28 hours. After a valid response, it polls every five to six minutes. A watchdog ends the process after about 28 hours ^[1][5]. Traffic uses AES-128-CBC with HMAC-SHA256 ^[1][11]. Certificate pinning is disabled ^[1]. The server domain resembles an AI service brand, sits behind Cloudflare and was first seen in September 2023, according to Kaspersky ^[1][4]. SecurityLab notes there is no confirmed link to the brand it imitates ^[11].

What is not known

The gaps are as important as the findings.

• Delivery. Kaspersky did not see how the archive reached the machine ^[1][2].
• Supply chain. Kaspersky calls a software supply-chain attack likely ^[6] but found no evidence that Patch My PC or its distribution systems were compromised ^[2][6]. Borncity carries no statement from Patch My PC, and this desk found none ^[5].
• Scale. One victim is known. How many systems were affected, and whether data was taken, is unknown ^[3].
• The platform. Kaspersky does not name the build. It notes a log path containing ‘CmitUpdateAgent’ that may be tied to it ^[1]. SecurityLab treats this as the only identifier and calls the link an inference ^[11].
• Attribution. None. The Record reports suspected state involvement; Kaspersky does not link the activity to any known group ^[1][3].

What it means

The target choice is the finding. Sergey Lozhkin, head of Kaspersky’s GReAT research centre for APAC and META, said technological sovereignty often starts with operating systems, and that running your own platform means securing the entire ecosystem around it ^[6]. Kaspersky’s report concludes that immature sovereign ecosystems may expose additional attack vectors until they mature ^[1].

The intruder appears to have studied that ecosystem. The Record reports the researchers’ view that the handling of government-specific Windows components suggests detailed knowledge of the target’s technology ^[3].

Three properties of the chain defeat common controls.

• Signature trust. Each executable and the Microsoft module were legitimate ^[1][2]. Allow-listing by signer would pass them.
• Short-window analytics. A 22-to-28-hour retry interval sits outside the look-back of many beaconing detections ^[1].
• Local evidence. The loader removes exactly the artefacts responders use to reconstruct .NET execution and update activity ^[1][4].

MITRE’s guidance for compromised update chains is to correlate updater process creation, first-run child processes, unusual module loads and outbound connections to unexpected hosts in a short window ^[9]. NetamLoader’s delays are designed to stretch that window.

The regional context is government espionage. ESET’s activity report for April to September 2026 says China-aligned groups focused mainly on government targets during the period ^[10]. Kaspersky makes no link between NetamLoader and those groups, and neither does this article.

What to do

These steps apply to any standardised government build or managed desktop image, not only a national operating system.

• Watch update folders. Alert on CAB archives and extracted .config, .resx or executable files in SoftwareDistribution that did not come from your update service ^[2][5].
• Hunt for .config files beside signed .NET executables that set an AppDomainManager, and for assemblies loaded through non-standard configuration files ^[7].
• Alert when the .NET event-tracing provider is disabled through environment variables, and on dllhost.exe making outbound connections ^[4].
• Restrict third-party management tools to approved, write-protected locations. MITRE’s mitigation is to block writes to the search paths .NET applications use ^[2][7].
• Forward process, .NET and update logs off the endpoint, so that local deletion leaves a visible gap ^[2][6].
• Extend beacon analytics to multi-day intervals for high-value hosts ^[1].
• Retire BinaryFormatter in in-house .NET code, as Microsoft recommends ^[8].
• Check Kaspersky’s published indicators against update directories and proxy logs ^[1].

For APAC governments that run their own builds, golden images or patch tooling, the burden Lozhkin describes is theirs alone ^[6]. The update channel is part of the perimeter. It should be monitored as one.