NetamLoader malware targets government Windows 10 systems in Asia via .NET injection
Original title: NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Custom .NET loader NetamLoader deployed via CAB archive targets Windows 10 China Government Edition, using AppDomainManager injection.
Kaspersky disclosed a .NET assembly-loading framework codenamed NetamLoader deployed via CAB archive in a trusted update path. The chain uses AppDomainManager injection to load payloads including XAML loaders and .NET assemblies that poll C2 at openaigpt4v[.]com. A single victim in Asia was identified, with the targeted build likely the Chinese Government Edition.
Unconfirmed: Number of compromised systems and exact country
- AppDomainManager injection technique
- Delivery via CAB archive in SoftwareDistribution path
- Two-stage infection chain
- Targets Windows 10 government build
- Polls C2 for XAML payloads
Impact: code execution on targeted government systems
- Vendors
- Patch My PC
- Products
- Windows 10
- Malware
- NetamLoader
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | openaigpt4v.com | minutes before issuing its first request to the C2 server ("openaigpt4v[.]com"), and enters into a periodic polling loop to fetch an XA |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented . NET assembly-loading framework codenamed
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.