NetamLoader abuses .NET assembly loading and interferes with AMSI scanning, enabling malicious code execution through legitimate software on targeted endpoints.
Kaspersky identified one victim in Asia, but researchers have not attributed the attack to any known threat actor or group.
NetamLoader abuses .NET configuration through AppDomainManager injection. Restrict application directory write permissions and monitor suspicious assembly loading and process behavior.
Hexnode XDR supports inspecting process trees, terminating processes, quarantining files, and isolating compromised endpoints through administrator-led actions on supported devices.
NetamLoader malware targeted a customized Windows 10 build for government use in Asia, according to research Kaspersky published on October 29, 2026. The framework abuses legitimate software components to execute additional code and interfere with antimalware scanning.
The case raises an operational question for enterprise security teams: can investigators recognize malicious activity when trusted programs perform it? Administrators should examine configuration changes, execution context, and network behavior together. A legitimate executable alone does not establish that its activity is safe.
What investigators established
Kaspersky began investigating during the first half of 2026 after detecting a suspicious configuration file inside a CAB archive in a Windows update directory. The archive contained legitimate Patch My PC components alongside supporting files that redirected execution.
Researchers suspect a supply-chain attack, but they did not observe the archive’s delivery. Kaspersky explicitly states that its findings do not indicate a compromise of Patch My PC or its distribution systems.
Treat the update-directory location as an investigative lead. It does not, by itself, prove that an attacker compromised an update service.
How NetamLoader malware executes and evades scanning
The framework combines configuration abuse with staged payload loading. Understanding these separate mechanisms helps analysts choose relevant evidence.
Configuration-driven .NET execution
AppDomainManager injection: This technique manipulates how .NET applications initialize application domains and load assemblies. MITRE tracks it as T1574.014.
Configuration abuse: Attackers alter configuration files or environment variables so legitimate applications load attacker-selected code.
Payload loading: A modified configuration for PatchMyPC-ScriptRunner.exe loads a Microsoft-signed assembly. That assembly reads fabric.config and then Resources.resx, which contains the concealed payload chain.
Investigation priority: Analysts should examine accompanying configuration and resource files alongside executable signatures to identify unauthorized changes.
What is Threat Analysis?
Understand threat analysis, investigate suspicious activity, and prioritize security responses.
AMSI interference and subsequent execution
AMSI’s role: AMSI connects applications with antimalware products and supports inspection of files, memory, and streams. It represents one component of endpoint protection.
Scanning interference: NetamLoader redirects an AMSI scanning method in a 64-bit process to manipulate scan results.
Subsequent execution: The loader removes selected local artifacts before transferring execution to dllhost.exe, where a plugin retrieves additional XAML payloads.
Delayed communication: The analyzed configuration waits 20–40 minutes before its first command-and-control request. An unsuccessful response can extend the next attempt to 22–28 hours.
Investigation implications: Brief monitoring periods may miss delayed network activity. An AMSI bypass does not establish that the malware defeats every endpoint detection mechanism.
What enterprise teams should investigate
Prioritize relationships between files, processes, and destinations. Use the following checks to guide triage rather than treating every matching filename as proof of infection.
Investigation area
Security concern
Response priority
Application configuration
Unexpected assembly loading
Compare with approved configurations
Update directories
Unexplained executable packages
Establish origin and deployment history
Process activity
Suspicious execution context
Correlate commands, modules, and timestamps
Network records
Infrequent external connections
Review historical DNS and proxy evidence
MITRE recommends protecting .NET application directories against unauthorized writes and correlating configuration tampering with unusual module loading. Apply these controls to maintenance tools as well as business applications.
For customized Windows environments, validate monitoring coverage against the actual build. Include agent operation, event collection, retention, and response testing in that assessment. Do not assume compatibility merely because the operating system carries a Windows name.
Response priorities for IT and security teams
Use the published indicators to scope an investigation, then resolve the evidence into specific actions:
Preserve evidence: Collect relevant configuration files, process records, and network history before destructive cleanup. Record collection times and retain original samples under your incident-handling procedures.
Establish package provenance: Compare suspicious packages with approved deployment records. Identify the account, tool, and maintenance activity associated with their placement.
Review permissions: Check who can modify application directories and runtime configuration files. Remove unnecessary write access after assessing operational dependencies.
Contain confirmed activity: Follow your incident response process when evidence supports compromise. Coordinate endpoint isolation with operational owners, especially where devices support critical services.
Validate recovery: Recheck configuration integrity and monitoring coverage before returning an endpoint to normal operation. Track unresolved delivery questions separately from completed cleanup.
These steps form an investigation workflow, not a claim that every organization faces the same exposure. Assign an owner to each finding and record the evidence supporting closure.
Maintain a separate record of confirmed findings, working hypotheses, and unanswered questions so subsequent reviews do not turn assumptions into conclusions.
Featured resource
Cybersecurity kit
Download this cybersecurity kit for frameworks, checklists, policies, and guides to strengthen your business security.
NetamLoader’s use of legitimate executables makes execution context important for investigation. On supported Windows endpoints, Hexnode XDR helps administrators examine incident activity and take targeted containment actions.
Process Tree: Inspect available parent-child relationships and command-line details associated with a detected incident. Correlate these observations with other evidence when investigating suspicious activity involving PatchMyPC-ScriptRunner.exe or dllhost.exe.
Kill Process/Kill Process Tree: Terminate a process or its associated child processes after confirming malicious activity. Assess the specific process instance before stopping a legitimate Windows executable.
Quarantine File/Delete File: Isolate identified malicious files remaining on the endpoint. Stop active malicious execution before quarantining associated files.
Isolate device: Restrict network access to interrupt command-and-control communication while preserving the endpoint’s connection to the XDR console.
These capabilities help security teams move from investigating suspicious execution to containing confirmed endpoint activity. Confirm compatibility with the specific Windows build before deployment.
FAQs
Did attackers steal government data?
Public reporting does not establish sensitive-data theft. It also leaves the broader scope beyond the identified victim unresolved.
Does this affect every Windows 10 device?
The reported targeting concerns a customized government build. That finding does not establish a campaign against every Windows 10 deployment.
Can a security patch prevent NetamLoader attacks?
Patching alone does not address NetamLoader’s abuse of .NET configuration and assembly loading. Restrict write permissions on application directories, monitor suspicious execution, and apply relevant security updates to address exploitable vulnerabilities.
Conclusion
NetamLoader malware highlights the need to assess how legitimate software executes, which configurations control it, and what evidence survives an incident. Enterprise teams should connect endpoint observations with deployment and network records, investigate unexplained changes, and validate recovery. Effective response depends on evidence across the execution chain and clear operational ownership.
Investigate endpoint threats with Hexnode XDR.
Review endpoint incidents and coordinate response actions with Hexnode XDR.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
