NetamLoader found on one Asian government Windows 10 system
October 30: later reports add the openaigpt4v[.]com C2, a Cloudflare address, AMSI patching, log deletion, polling delays, and that Patch My PC itself was not compromised.
Kaspersky found unattributed NetamLoader on one custom government Windows 10 system in Asia; delivery remains unconfirmed.
Kaspersky identified NetamLoader, a .NET loader, on one computer in the first half of 2026. The host ran a specialized Windows 10 build used only by government organizations in Asia. A CAB in the Windows update download folder mixed legitimate Patch My PC and Microsoft-signed files with a configuration that used AppDomainManager injection and nested Resources.resx stages. Those stages can patch AMSI, delete logs, collect host data, and contact openaigpt4v[.]com. Kaspersky suspects a supply-chain attack, says Patch My PC itself was not compromised, did not observe how the CAB arrived, and named no known group.
- Only one infected system was identified, in the first half of 2026.
- CAB hash e4537a1762fcafd2fd96bfc825bad34f9db9a24d was under SoftwareDistribution\Download.
- PatchMyPC-ScriptRunner.exe ran with an -updatepackage argument as the host.
- The plugin waits 20–40 minutes, then polls every 5–6 minutes.
- GBHackers names C2 address 104.18.14.219 behind Cloudflare.
- Kaspersky detects it as HEUR:Trojan.MSIL.NetamLoader.gen and related families.
Timeline
dated events in the reporting · oldest first- Oct 29, 2026Securelist publishes the NetamLoader analysis · Cyber Security News
What each outlet adds
beyond the shared facts- Kaspersky SecurelistAppDomainManager injection, CAB hash, and detection names
- The RecordOne victim; no proven data theft or update-infrastructure compromise
- Cyber Security NewsPatch My PC not compromised; 22–28 hour C2 retry
- GBHackersAMSI bypass, dllhost, polling interval, and Cloudflare C2
- Vendors
- Microsoft
- Products
- WindowsPatch My PCWindows 10
- Malware
- NetamLoaderZapchast
- Organizations
- Kaspersky
Coverage
oldest first · one row per article · UTC- · 1d ago
Kaspersky SecurelistFirst report
Unknown APT deploys NetamLoader on government Windows 10 builds in Asia
Kaspersky traced a CAB in the Windows update folder to AppDomainManager injection and a layered .NET loader.
- · 8h ago
The Record
Kaspersky finds NetamLoader on one Asian government Windows system
The loader uses signed Microsoft components, can hide activity, and its delivery path is unconfirmed.
- · 5h ago
Cyber Security News
NetamLoader hides in Windows 10 update packages aimed at Asian governments
Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.
- · 5h ago
GBHackers
Kaspersky finds NetamLoader in Windows update files on Asian government systems
One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.