Netam Loader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Summary: Kaspersky disclosed a highly sophisticated infection chain targeting government organizations in Asia, deploying a previously undocumented .NET assembly-loading framework codenamed NetamLoader inside a Windows CAB archive placed in the SoftwareDistribution\Download update-package directory. The sample uses AppDomainManager injection via a .config file to load arbitrary .NET assemblies, and Kaspersky's telemetry identified a single victim running a Windows 10 build customized for government-only use, with the attack unattributed and the CAB delivery vehicle unknown.
Key Takeaway: The implant sat in the directory Windows uses for its own update packages, and four of the seven files in the archive were legitimate Patch My PC components - so the tooling that looks trustworthy was the cover. Kaspersky found one victim, but the target was a government-only OS build, which means the exposure is scoped to whoever else runs that same custom platform.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026