{"id":2471,"date":"2026-11-02T12:01:57","date_gmt":"2026-11-02T06:31:57","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=2471"},"modified":"2026-11-03T14:56:28","modified_gmt":"2026-11-03T09:26:28","slug":"netamloader-malware-endpoint-investigation","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/","title":{"rendered":"NetamLoader Malware: .NET Attacks on Government Endpoints"},"content":{"rendered":"<p>NetamLoader malware targeted a customized Windows 10 build for government use in Asia, according to research Kaspersky published on October 29, 2026. The framework abuses legitimate software components to execute additional code and interfere with antimalware scanning.<\/p>\n<p>The case raises an operational question for enterprise security teams: can investigators recognize malicious activity when trusted programs perform it? Administrators should examine configuration changes, execution context, and network behavior together. A legitimate executable alone does not establish that its activity is safe.<\/p>\n<h2>What investigators established<\/h2>\n<p>Kaspersky began investigating during the first half of 2026 after detecting a suspicious configuration file inside a CAB archive in a Windows update directory. The archive contained legitimate Patch My PC components alongside supporting files that redirected execution.<\/p>\n<p>Researchers suspect a <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-supply-chain-attack\/\">supply-chain attack<\/a>, but they did not observe the archive\u2019s delivery. Kaspersky explicitly states that its findings do not indicate a compromise of Patch My PC or its distribution systems.<\/p>\n<p>Treat the update-directory location as an investigative lead. It does not, by itself, prove that an attacker compromised an update service.<\/p>\n<h2>How NetamLoader malware executes and evades scanning<\/h2>\n<p>The framework combines configuration abuse with staged payload loading. Understanding these separate mechanisms helps analysts choose relevant evidence.<\/p>\n<h3>Configuration-driven .NET execution<\/h3>\n<ul>\n<li><strong>AppDomainManager injection:<\/strong> This technique manipulates how .NET applications initialize application domains and load assemblies. MITRE tracks it as T1574.014.<\/li>\n<li><strong>Configuration abuse:<\/strong> Attackers alter configuration files or environment variables so legitimate applications load attacker-selected code.<\/li>\n<li><strong>Payload loading:<\/strong> A modified configuration for PatchMyPC-ScriptRunner.exe loads a Microsoft-signed assembly. That assembly reads fabric.config and then Resources.resx, which contains the concealed payload chain.<\/li>\n<li><strong>Investigation priority:<\/strong> Analysts should examine accompanying configuration and resource files alongside executable signatures to identify unauthorized changes.<\/li>\n<\/ul>\n<div class=\"next_blog\"><div class=\"post-next\"><div class=\"hex_blog_box_parent\"><div class=\"blog_warp_next\"><div class=\"next_blog_thumb\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/threat-analysis-.jpeg?format=webp)\"><\/div><div class=\"next_post_content\"><div class=\"center_box\"><h4>What is Threat Analysis?<\/h4><p>Understand threat analysis, investigate suspicious activity, and prioritize security responses.<\/p><\/div><\/div><\/div><a class=\"hex_blog_box_link hn-cta__blogs--blog-box\" href=\"https:\/\/www.hexnode.com\/blogs\/what-is-threat-analysis\/\" aria-label=\"What is Threat Analysis?\"><\/a><\/div><\/div><\/div>\n<h2>AMSI interference and subsequent execution<\/h2>\n<ul>\n<li><strong>AMSI\u2019s role:<\/strong> AMSI connects applications with <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-anti-malware\/\">antimalware<\/a> products and supports inspection of files, memory, and streams. It represents one component of endpoint protection.<\/li>\n<li><strong>Scanning interference:<\/strong> NetamLoader redirects an AMSI scanning method in a 64-bit process to manipulate scan results.<\/li>\n<li><strong>Subsequent execution:<\/strong> The loader removes selected local artifacts before transferring execution to dllhost.exe, where a plugin retrieves additional XAML payloads.<\/li>\n<li><strong>Delayed communication:<\/strong> The analyzed configuration waits 20\u201340 minutes before its first <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-a-command-and-control-server\/\">command-and-control<\/a> request. An unsuccessful response can extend the next attempt to 22\u201328 hours.<\/li>\n<li><strong>Investigation implications:<\/strong> Brief monitoring periods may miss delayed network activity. An AMSI bypass does not establish that the malware defeats every endpoint detection mechanism.<\/li>\n<\/ul>\n<h2>What enterprise teams should investigate<\/h2>\n<p>Prioritize relationships between files, processes, and destinations. Use the following checks to guide triage rather than treating every matching filename as proof of infection.<\/p>\n<table style=\"width: 81.8566%;\">\n<thead>\n<tr>\n<th style=\"width: 29.6542%; text-align: left;\"><strong>Investigation area<\/strong><\/th>\n<th style=\"width: 33.632%; text-align: left;\"><strong>Security concern<\/strong><\/th>\n<th style=\"width: 35.2963%; text-align: left;\"><strong>Response priority<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"width: 29.6542%;\">Application configuration<\/td>\n<td style=\"width: 33.632%;\">Unexpected assembly loading<\/td>\n<td style=\"width: 35.2963%;\">Compare with approved configurations<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 29.6542%;\">Update directories<\/td>\n<td style=\"width: 33.632%;\">Unexplained executable packages<\/td>\n<td style=\"width: 35.2963%;\">Establish origin and deployment history<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 29.6542%;\">Process activity<\/td>\n<td style=\"width: 33.632%;\">Suspicious execution context<\/td>\n<td style=\"width: 35.2963%;\">Correlate commands, modules, and timestamps<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 29.6542%;\">Network records<\/td>\n<td style=\"width: 33.632%;\">Infrequent external connections<\/td>\n<td style=\"width: 35.2963%;\">Review historical DNS and proxy evidence<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>MITRE recommends protecting .NET application directories against unauthorized writes and correlating configuration tampering with unusual module loading. Apply these controls to maintenance tools as well as business applications.<\/p>\n<p>For customized Windows environments, validate monitoring coverage against the actual build. Include agent operation, event collection, retention, and response testing in that assessment. Do not assume compatibility merely because the operating system carries a Windows name.<\/p>\n<h2>Response priorities for IT and security teams<\/h2>\n<p>Use the published indicators to scope an investigation, then resolve the evidence into specific actions:<\/p>\n<ul>\n<li><strong>Preserve evidence:<\/strong> Collect relevant configuration files, process records, and network history before destructive cleanup. Record collection times and retain original samples under your incident-handling procedures.<\/li>\n<li><strong>Establish package provenance:<\/strong> Compare suspicious packages with approved deployment records. Identify the account, tool, and maintenance activity associated with their placement.<\/li>\n<li><strong>Review permissions:<\/strong> Check who can modify application directories and runtime configuration files. Remove unnecessary write access after assessing operational dependencies.<\/li>\n<li><strong>Contain confirmed activity:<\/strong> Follow your incident response process when evidence supports compromise. Coordinate endpoint isolation with operational owners, especially where devices support critical services.<\/li>\n<li><strong>Validate recovery:<\/strong> Recheck configuration integrity and monitoring coverage before returning an endpoint to normal operation. Track unresolved delivery questions separately from completed cleanup.<\/li>\n<\/ul>\n<p>These steps form an investigation workflow, not a claim that every organization faces the same exposure. Assign an owner to each finding and record the evidence supporting closure.<\/p>\n<p>Maintain a separate record of confirmed findings, working hypotheses, and unanswered questions so subsequent reviews do not turn assumptions into conclusions.<\/p>\n<section id='resource-single'>\n                    <div class='resource-box'>\n                        <div class='resource-box__image-section'>\n                            <div class='resource-box__image-wrap'>\n                                <img decoding=\"async\" src=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit-.jpg?format=webp\" class=\"resource-box__image\" alt=\"cybersecurity kit\" loading=\"lazy\" srcset=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit-.jpg?format=webp 960w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--300x225.jpg?format=webp 300w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--768x576.jpg?format=webp 768w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--133x100.jpg?format=webp 133w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" title=\"cybersecurity kit\" \/>\n                            <\/div>\n                        <\/div>\n                        <div class='resource-box__content-section'>\n                            <h5 class='resource-box__content-subheading'>\n                            Featured resource\n                            <\/h5>\n                            <h4 class='resource-box__content-heading'>\n                            Cybersecurity kit\n                            <\/h4>\n                            <p class='resource-box__contents'>\n                            Download this cybersecurity kit for frameworks, checklists, policies, and guides to strengthen your business security.\n                            <\/p>\n                            <a class='resource-box__content-link hn-cta__blogs--resource-box' href='https:\/\/www.hexnode.com\/resources\/resource-kits\/cybersecurity-kit\/'>\n                            DOWNLOAD\n                            <svg xmlns='http:\/\/www.w3.org\/2000\/svg' width='20' height='20' viewBox='0 0 20 20'>\n                            <g id='arrow' transform='translate(-309 -191)' opacity='0'>\n                                <rect id='base' width='20' height='20' transform='translate(309 191)' fill='none'\/>\n                                <path id='arrow-2' data-name='arrow' d='M13.093.5,6.8,6.8.5.5' transform='translate(315 207.594) rotate(-90)' fill='none' stroke='#0549d1' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.2'\/>\n                            <\/g>\n                            <\/svg>\n\n                            <\/a>\n                        <\/div>\n                    <\/div>\n                <\/section>\n<h2>How Hexnode XDR supports endpoint investigation<\/h2>\n<p>NetamLoader\u2019s use of legitimate executables makes execution context important for investigation. On supported Windows endpoints, <a href=\"https:\/\/www.hexnode.com\/xdr\/\">Hexnode XDR<\/a> helps administrators examine incident activity and take targeted containment actions.<\/p>\n<ul>\n<li><strong>Process Tree:<\/strong> Inspect available parent-child relationships and command-line details associated with a detected incident. Correlate these observations with other evidence when investigating suspicious activity involving PatchMyPC-ScriptRunner.exe or dllhost.exe.<\/li>\n<li><strong>Kill Process\/Kill Process Tree:<\/strong> Terminate a process or its associated child processes after confirming malicious activity. Assess the specific process instance before stopping a legitimate Windows executable.<\/li>\n<li><strong>Quarantine File\/Delete File:<\/strong> Isolate identified malicious files remaining on the endpoint. Stop active malicious execution before quarantining associated files.<\/li>\n<li><strong>Isolate device:<\/strong> Restrict network access to interrupt command-and-control communication while preserving the endpoint\u2019s connection to the XDR console.<\/li>\n<\/ul>\n<p>These capabilities help security teams move from investigating suspicious execution to containing confirmed endpoint activity. Confirm compatibility with the specific Windows build before deployment.<\/p>\n<div class=\"faq-section-wrapper\" itemscope itemtype=\"https:\/\/schema.org\/FAQPage\"><h2 class=\"faq-main-title\">FAQs<\/h2><div class=\"faq-items\"><div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Did attackers steal government data?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>Public reporting does not establish sensitive-data theft. It also leaves the broader scope beyond the identified victim unresolved.<\/p>\n<\/div><\/div><\/div>\n<div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Does this affect every Windows 10 device?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>The reported targeting concerns a customized government build. That finding does not establish a campaign against every Windows 10 deployment.<\/p>\n<\/div><\/div><\/div>\n<div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Can a security patch prevent NetamLoader attacks?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>Patching alone does not address NetamLoader\u2019s abuse of .NET configuration and assembly loading. Restrict write permissions on application directories, monitor suspicious execution, and apply relevant security updates to address exploitable vulnerabilities.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n<h3>Conclusion<\/h3>\n<p>NetamLoader malware highlights the need to assess how legitimate software executes, which configurations control it, and what evidence survives an incident. Enterprise teams should connect endpoint observations with deployment and network records, investigate unexplained changes, and validate recovery. Effective response depends on evidence across the execution chain and clear operational ownership.<\/p>\n<div class=\"signup_box\"><div class=\"signup_wrap_img\"><div class=\"signup-bg\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/Hexnode-MDM-free-trial.jpg?format=webp)\"><\/div><\/div><div class=\"signup_wrap\"><h5>Investigate endpoint threats with Hexnode XDR.<\/h5><p>Review endpoint incidents and coordinate response actions with Hexnode XDR.<\/p><a href=\"https:\/\/www.hexnode.com\/xdr\/signup\/\" class=\"hn-cta__blogs--signup-stripe\" target=\"_blank\"> SIGN UP NOW<\/a><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>NetamLoader malware targeted a customized Windows 10 build for government use in Asia, according to&#8230;<\/p>\n","protected":false},"author":5,"featured_media":2506,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[15,16],"class_list":["post-2471","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware","category-windows","product_category-extended-detection-and-response","tab_group-malware-and-ransomware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>NetamLoader Malware: Government Windows Endpoints Targeted<\/title>\n<meta name=\"description\" content=\"Explore NetamLoader malware, its .NET injection and AMSI bypass, and endpoint investigation priorities for enterprise IT security teams.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NetamLoader Malware: Government Windows Endpoints Targeted\" \/>\n<meta property=\"og:description\" content=\"Explore NetamLoader malware, its .NET injection and AMSI bypass, and endpoint investigation priorities for enterprise IT security teams.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/\" \/>\n<meta property=\"og:site_name\" content=\"Hexnode Threat Watch\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hexnode\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T06:31:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-03T09:26:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/11\/netamloader-malware.jpeg?format=webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1340\" \/>\n\t<meta property=\"og:image:height\" content=\"700\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sophia Hart\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:site\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sophia Hart\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/\"},\"author\":{\"name\":\"Sophia Hart\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\"},\"headline\":\"NetamLoader Malware: .NET Attacks on Government Endpoints\",\"datePublished\":\"2026-11-02T06:31:57+00:00\",\"dateModified\":\"2026-11-03T09:26:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/\"},\"wordCount\":1060,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/netamloader-malware.jpeg?format=webp\",\"articleSection\":[\"Malware\",\"Windows\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/\",\"name\":\"NetamLoader Malware: Government Windows Endpoints Targeted\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/netamloader-malware.jpeg?format=webp\",\"datePublished\":\"2026-11-02T06:31:57+00:00\",\"dateModified\":\"2026-11-03T09:26:28+00:00\",\"description\":\"Explore NetamLoader malware, its .NET injection and AMSI bypass, and endpoint investigation priorities for enterprise IT security teams.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/netamloader-malware.jpeg?format=webp\",\"contentUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/netamloader-malware.jpeg?format=webp\",\"width\":1340,\"height\":700,\"caption\":\"netamloader malware\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/netamloader-malware-endpoint-investigation\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NetamLoader Malware: .NET Attacks on Government Endpoints\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"name\":\"Hexnode Threat Watch\",\"description\":\"Latest cyber threats, smarter enterprise response.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"alternateName\":\"Threat Watch\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\",\"name\":\"Hexnode\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"contentUrl\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"width\":100,\"height\":100,\"caption\":\"Hexnode\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Hexnode\\\/\",\"https:\\\/\\\/x.com\\\/thehexnode\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/hexnode\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\",\"name\":\"Sophia Hart\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"caption\":\"Sophia Hart\"},\"description\":\"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/author\\\/sophia-hart\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NetamLoader Malware: Government Windows Endpoints Targeted","description":"Explore NetamLoader malware, its .NET injection and AMSI bypass, and endpoint investigation priorities for enterprise IT security teams.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/","og_locale":"en_US","og_type":"article","og_title":"NetamLoader Malware: Government Windows Endpoints Targeted","og_description":"Explore NetamLoader malware, its .NET injection and AMSI bypass, and endpoint investigation priorities for enterprise IT security teams.","og_url":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/","og_site_name":"Hexnode Threat Watch","article_publisher":"https:\/\/www.facebook.com\/Hexnode\/","article_published_time":"2026-11-02T06:31:57+00:00","article_modified_time":"2026-11-03T09:26:28+00:00","og_image":[{"width":1340,"height":700,"url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/11\/netamloader-malware.jpeg?format=webp","type":"image\/jpeg"}],"author":"Sophia Hart","twitter_card":"summary_large_image","twitter_creator":"@thehexnode","twitter_site":"@thehexnode","twitter_misc":{"Written by":"Sophia Hart","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#article","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/"},"author":{"name":"Sophia Hart","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430"},"headline":"NetamLoader Malware: .NET Attacks on Government Endpoints","datePublished":"2026-11-02T06:31:57+00:00","dateModified":"2026-11-03T09:26:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/"},"wordCount":1060,"commentCount":0,"publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/11\/netamloader-malware.jpeg?format=webp","articleSection":["Malware","Windows"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/","url":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/","name":"NetamLoader Malware: Government Windows Endpoints Targeted","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#primaryimage"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/11\/netamloader-malware.jpeg?format=webp","datePublished":"2026-11-02T06:31:57+00:00","dateModified":"2026-11-03T09:26:28+00:00","description":"Explore NetamLoader malware, its .NET injection and AMSI bypass, and endpoint investigation priorities for enterprise IT security teams.","breadcrumb":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#primaryimage","url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/11\/netamloader-malware.jpeg?format=webp","contentUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/11\/netamloader-malware.jpeg?format=webp","width":1340,"height":700,"caption":"netamloader malware"},{"@type":"BreadcrumbList","@id":"https:\/\/www.hexnode.com\/threat-watch\/netamloader-malware-endpoint-investigation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hexnode.com\/threat-watch\/"},{"@type":"ListItem","position":2,"name":"NetamLoader Malware: .NET Attacks on Government Endpoints"}]},{"@type":"WebSite","@id":"https:\/\/www.hexnode.com\/threat-watch\/#website","url":"https:\/\/www.hexnode.com\/threat-watch\/","name":"Hexnode Threat Watch","description":"Latest cyber threats, smarter enterprise response.","publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"alternateName":"Threat Watch","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hexnode.com\/threat-watch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization","name":"Hexnode","url":"https:\/\/www.hexnode.com\/threat-watch\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/","url":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","contentUrl":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","width":100,"height":100,"caption":"Hexnode"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hexnode\/","https:\/\/x.com\/thehexnode","https:\/\/www.linkedin.com\/company\/hexnode"]},{"@type":"Person","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430","name":"Sophia Hart","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","caption":"Sophia Hart"},"description":"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.","url":"https:\/\/www.hexnode.com\/threat-watch\/author\/sophia-hart\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/comments?post=2471"}],"version-history":[{"count":7,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2471\/revisions"}],"predecessor-version":[{"id":2496,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/2471\/revisions\/2496"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media\/2506"}],"wp:attachment":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media?parent=2471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/categories?post=2471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}