596/69 Monday, November 2, 2026
Cybersecurity researchers from Kaspersky have disclosed a sophisticated campaign targeting government organizations in Asia. The attacks use a newly identified malware framework named NetamLoader to compromise specially customized Windows 10 systems deployed within government environments. Researchers believe the activity may be related to a supply chain attack, in which threat actors could have compromised a trusted third-party provider to reach downstream users. The campaign highlights risks to government software infrastructure, although the threat actor behind the operation has not yet been identified and the extent of any data compromise remains unconfirmed.
Analysis shows that the attack chain consists of two stages and begins with a CAB archive placed inside the Windows update download directory. In the first stage, the malware uses AppDomainManager Injection by launching the legitimate-looking PatchMyPC-ScriptRunner.exe file, causing the system to process a modified PatchMyPC-ScriptRunner.exe.config file. It then loads Microsoft.HostIntegration.Connectors.dll, reads configuration data from fabric.config, and extracts malicious code hidden inside Resources.resx. The second stage involves multiple layers of payload decryption. The malware uses a XAML file (XAML-2-1) to patch and bypass the Windows Antimalware Scan Interface (AMSI), before passing data through a .NET 1 Loader that prepares configuration information for communication with a Command-and-Control (C2) server. It also abuses the legitimate dllhost.exe process to execute a .NET 2 Plugin, helping conceal its activity, remain dormant when necessary, and remove traces of the attack.
The incident highlights the security challenges associated with maintaining customized operating system environments, where organizations must also assume responsibility for protecting the broader supporting software ecosystem. Administrators and relevant agencies should strengthen monitoring, particularly by checking for suspicious files in C:\Windows\SoftwareDistribution\Download\ and abnormal activity involving the dllhost.exe process. Organizations should also verify the integrity of files associated with endpoint management software and monitor outbound network connections to suspicious domains that may function as command-and-control infrastructure, helping reduce the risk of compromise from similar attacks.
Source: https://thehackernews.com/2026/11/netamloader-malware-targets-government.html