Kaspersky's GReAT published research on Securelist on 29 October 2026 on NetamLoader, a complex .NET assembly-loading framework built on XAML markup that Kaspersky says strongly indicates a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia.

Kaspersky says the sample came to light in the first half of 2026 when Kaspersky Security Network flagged a .config file using AppDomainManager injection to load arbitrary .NET assemblies; the file was packed in a CAB archive in the folder that stores Windows update packages (C:\Windows\SoftwareDistribution\Download).

According to Kaspersky, most executables in the archive were legitimate components of the third-party patch management tool Patch My PC and the .NET assemblies used for the injection were Microsoft-signed; only a Resources.resx file contained malicious code, and Kaspersky says it did not observe how the CAB file was delivered to the victim.

Kaspersky says the chain abuses a Windows Server AppFabric cache client configuration class and .NET BinaryFormatter deserialization (TypeConfuseDelegate) to load layered XAML payloads, patches AMSI so every scan returns clean, deletes update records, CLR usage logs and Prefetch files, filters update-agent logs in a path containing 'CmitUpdateAgent' (which it says may be linked to a custom Windows 10 build used by a government in Asia), turns off .NET ETW events, and runs its final .NET plugin inside dllhost.exe, with C2 polling delays of 22 to 28 hours when the server does not respond. Based on its telemetry, Kaspersky identified a single victim in Asia, and because the malware was designed for a customised government-only version of Windows it infers the victims are Asian government entities; it says it could not link the attack to any known APT group.

Kaspersky's report includes file hashes, file paths and network indicators. (source: Kaspersky Securelist)