Kaspersky finds NetamLoader in Windows update files on Asian government systems
Original title: Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files
One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.
Kaspersky described NetamLoader, a .NET loader found in a CAB under the Windows update download folder on a customized build used by Asian government bodies. Legitimate Patch My PC files and Microsoft-signed assemblies sit with Resources.resx, which starts XAML stages, disables AMSI, and launches more code in dllhost.exe. The final plugin contacts openaigpt4v[.]com. No known group is linked, and telemetry showed one Asian victim.
Unconfirmed: The supply-chain path, actor, and any victims beyond the one observed case are unconfirmed; the wider government focus is inferred.
- XAML-1 derives an AES key from the host command line.
- The plugin waits 20–40 minutes, then polls every 5–6 minutes.
- The named C2 address 104.18.14.219 is behind Cloudflare.
- The loader deletes update records, CLR logs, and Prefetch files.
Impact: Runs attacker XAML and keeps encrypted C2 on targeted hosts
| Product | Affected |
|---|---|
| Microsoft Windows | customized build used only by Asian government bodies |
- 1.Watch for unexpected .config files beside .NET executables in SoftwareDistribution\Download\Install.
- 2.Alert on AMSI tampering and dllhost.exe launched through COM.
- ATT&CK
- T1195 Supply Chain CompromiseT1562.001 Impair Defenses: Disable or Modify ToolsT1070 Indicator RemovalT1559.001 Inter-Process Communication: Component Object Model
- Vendors
- Microsoft
- Products
- WindowsPatch My PC
- Malware
- NetamLoader
- Organizations
- Kaspersky
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | openaigpt4v.com | L Architecture Diagram (Image Source: securelist) The C2 is openaigpt4v[.]com, behind Cloudflare at 104.18.14[.]219. Kaspersky saw one |
From the original article
2 min read at gbhackers.com
Kaspersky researchers have uncovered NetamLoader, a . NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies.
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.