Kaspersky has published details of NetamLoader, a previously undocumented framework that loads malicious .NET code and was aimed at a customized Windows 10 build used only by government entities in Asia. Kaspersky’s telemetry found a single victim and it has not linked the activity to any known threat group. The sample surfaced in the first half of 2026 as a .config file inside a Windows cabinet (CAB) archive placed in the folder where Windows stores update packages. Kaspersky says the structure strongly suggests a supply-chain attack, but it did not observe how the CAB arrived, and The Hacker News notes it is unclear whether other systems were affected or whether any data was stolen.
The trick is that almost nothing in the archive looks malicious. Of its seven files, four are legitimate components of the endpoint-management tool Patch My PC, and the .NET assemblies used are Microsoft-signed. Only Resources.resx carries code, wrapped in several layers of encoded, compressed or encrypted payloads. The launcher abuses AppDomainManager injection, which hijacks how a .NET Framework program initializes so that it loads attacker code, much like DLL sideloading. The later stages bypass the Antimalware Scan Interface (AMSI), run inside dllhost.exe, delete the extracted files along with .NET runtime logs and Windows Prefetch entries, and then poll a command-and-control server, openaigpt4v[.]com, after a random 20 to 40 minute delay. Kaspersky says the malware also edits log files and registry keys to hide its tracks. The Hacker News says the target was likely China, citing Microsoft’s China Government Edition of Windows 10 and an August Bloomberg report that Beijing told some agencies to stop using it; Kaspersky itself says only that it infers the victims are Asian government entities.
How to check if you’re affected
Affected devices are limited, on the evidence so far, to the customized government-only Windows 10 build Kaspersky describes; it found one victim. Administrators of such systems can look for the indicators Kaspersky lists:
- A folder
C:\Windows\SoftwareDistribution\Download\Install\containingPatchMyPC-ScriptRunner.exe.config,fabric.configandResources.resx, and a CAB archive namede4537a1762fcafd2fd96bfc825bad34f9db9a24dinC:\Windows\SoftwareDistribution\Download\. - Network traffic to
openaigpt4v[.]com. - Kaspersky’s published MD5 for the CAB archive,
F2458ED133F8D0CA19E22C10F577E98E, and forResources.resx,E1DC6F1ED193594F2284BE22AE08DFA4; the full hash list is in the report. - Kaspersky products detect the threat as
HEUR:Trojan.MSIL.NetamLoader.gen,Trojan.MSIL.Zapchast.*andTrojan.Script.Agent.*.
Because the Patch My PC files themselves are not malicious, a scan for those file names alone is not conclusive; the .config file and Resources.resx are the parts to examine.