Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

NetamLoader Targets Asian Gov Windows 10 via Update CABs

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Kaspersky identifies one NetamLoader victim in Asian government Windows 10 build, delivered in legitimate update CAB and contacting openaigpt4v[.]com after AMSI bypass.

Kaspersky reported NetamLoader, a .NET loader hidden in a CAB file under the Windows update download folder on a customized Asian government Windows 10 build. The malware uses legitimate Patch My PC files and Resources.resx to load XAML stages that bypass AMSI and beacon to openaigpt4v[.]com. A single victim was detected in the first half of 2026 with no linked threat group. The loader waits 22-28 hours before polling every 5-6 minutes and deletes update records, logs and Prefetch files.

Key facts
  • Detected as HEUR:Trojan.MSIL.NetamLoader.gen
  • Delivered via CAB in SoftwareDistribution\Download\Install
  • Contacts C2 at openaigpt4v[.]com
  • One Asian government victim identified
  • Bypasses AMSI with XAML stages
  • CAB hash: e4537a1762fcafd2fd96bfc825bad34f9db9a24d
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Securelist publishes report on NetamLoader · Cyber Security News
  2. Oct 30, 2026Cyber Security News and GBHackers report on NetamLoader · Cyber Security News
  3. Nov 1, 2026The Hacker News reports on NetamLoader · The Hacker News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsAdds CAB hash and HEUR:Trojan.MSIL.NetamLoader.gen detection
  • GBHackersDetails on C2 IP 104.18.14.219 and file deletion
  • The Hacker NewsAppDomainManager injection and Chinese Government Edition targeting
Vendors
MicrosoftPatch My PC
Products
WindowsPatch My PCWindows 10
Malware
NetamLoader
Victims
government organizations in Asia
Organizations
Kaspersky

Coverage

oldest first · one row per article · UTC
  1. · 12d ago Cyber Security NewsFirst report

    NetamLoader hides in Windows 10 update packages aimed at Asian governments

    Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.

  2. · 12d ago GBHackers

    Kaspersky finds NetamLoader in Windows update files on Asian government systems

    One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.