NetamLoader Hid in a Patch My PC Update to Spy on Asian Governments

An unidentified group is attacking a customized Windows 10 build used by government agencies in Asia with a new, almost fileless loader that Kaspersky calls NetamLoader, the company’s GReAT team says in new research. The malware arrived inside what looked like a routine update package, ran through a legitimate Patch My PC tool, and then hid inside a Windows system process. Kaspersky saw one victim and couldn’t tie the code or infrastructure to any known group.

openaigpt4v[.]com (behind Cloudflare, 104.18.14[.]219)
hxxps://openaigpt4v[.]com/model_v4/

C:\Windows\SoftwareDistribution\Download\Install\PatchMyPC-ScriptRunner.exe.config
C:\Windows\SoftwareDistribution\Download\Install\fabric.config
C:\Windows\SoftwareDistribution\Download\Install\Resources.resx
HKLM\SOFTWARE\Classes\appid\{ff259bcd-2f0a-44de-b34a-0092fec1d8a2} (DllSurrogate)
COMPlus_ETWEnabled=0

Source article: Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
Publisher: Kaspersky Securelist (Kaspersky GReAT)
Published: October 29, 2026
URL: https://securelist.com/netamloader/121676/

Executive Summary

NetamLoader is Kaspersky GReAT’s name for a multi-stage .NET and XAML loading framework used by an unattributed actor against government entities in Asia; no other vendor alias has been published, and Kaspersky found no code, TTP or infrastructure overlap with known groups. Kaspersky observed one victim through its telemetry and says the malware was built for a customized Windows 10 build used by governments, with a log folder named CmitUpdateAgent as the main clue to that build. Delivery was not observed and a supply-chain route is suspected. The chain starts with a CAB archive in C:\Windows\SoftwareDistribution\Download\ whose contents, mostly legitimate Patch My PC files, are extracted to ...\Download\Install\; launching PatchMyPC-ScriptRunner.exe -updatepackage loads a malicious PatchMyPC-ScriptRunner.exe.config that names a signed Microsoft assembly as AppDomainManager, which reads fabric.config and deserializes Resources.resx into XAML. Encrypted XAML stages, keyed to the host command line, patch AMSI, disable .NET ETW through COMPlus_ETWEnabled=0, delete the loader files, CLR usage log and Prefetch entry, strip lines from CmitUpdateAgent logs, clear AppID registry keys, and migrate through a remote COM activation into dllhost.exe using a DllSurrogate AppID. The resident plugin waits 20 to 40 minutes, polls openaigpt4v[.]com over HTTPS with AES-encrypted messages, runs downloaded XAML in isolated AppDomains, and exits after about 28 hours, with no persistence described. The objective appears to be espionage-grade remote code execution with minimal forensic footprint. Hunt leads, false positive expectations and indicators are detailed below; the source publishes no detection rules.

ATT&CK chain: Execution → Defense Evasion → Privilege Escalation → Command and Control

Hunt Lead Grid

NetamLoader Files and C2 Domain Sweep

Kaspersky found the loader staged as a CAB named by its 40-character hash, e4537a1762fcafd2fd96bfc825bad34f9db9a24d, in C:\Windows\SoftwareDistribution\Download\, with the malicious files PatchMyPC-ScriptRunner.exe.config, fabric.config and Resources.resx extracted to C:\Windows\SoftwareDistribution\Download\Install\. The loader deletes those three files once it runs, so they are most useful in backups, EDR file-creation history and volume shadow copies. The resident plugin talks only to openaigpt4v[.]com on URLs beginning hxxps://openaigpt4v[.]com/model_v4/ followed by a GUID, with ?b= and &c= parameters; Kaspersky’s infrastructure table shows the domain behind Cloudflare at 104.18.14[.]219 and first seen in September 2023. The detection logic is a retrospective search for the domain in DNS, proxy and TLS SNI logs, and for file-creation events of those three names or the CAB name under the Windows Update download path, plus a hash match against the values in the appendix.

Use DNS resolver logs, web proxy or firewall SNI logs, and EDR file telemetry. Sweep as far back as retention allows, at least to September 2023, because the domain is old and Kaspersky saw only one victim, which suggests the operation is narrow and long-running. Do not block or alert on 104.18.14[.]219 alone; it is a shared Cloudflare address and would bury you in noise. Hash blocking has little value here, since the first-stage key is derived from each host’s command line and the payload files are deleted; the hashes are for retrospective matching. Any hit on the domain from a government or high-value workstation should go straight to incident response, because the plugin executes arbitrary attacker-supplied code.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (our mapping; the source lists no ATT&CK IDs)

Sources: “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”, Kaspersky Securelist, Oct. 29, 2026, https://securelist.com/netamloader/121676/ (source article)

DllSurrogate AppID Registry Artifact

To run inside dllhost.exe, the second-stage plugin clears a set of GUID-named keys under HKLM\SOFTWARE\Classes\appid\ (nine in the loader, twelve in the plugin, with GUIDs derived from the C2 URL) and then creates HKLM\SOFTWARE\Classes\appid\{ff259bcd-2f0a-44de-b34a-0092fec1d8a2} with a DllSurrogate value set to an empty string, which tells Windows to host the COM server in the default surrogate. Kaspersky also lists HKLM\SOFTWARE\Classes\appid\{bde7ddc2-1f6f-4397-a0df-ae7c7d67d65a} as an exception marker written by the malware. The detection logic is a registry audit and a live rule for creation of either key, and more generally for new AppID keys with an empty DllSurrogate value written by a process other than an installer.

Use EDR registry telemetry or Sysmon event IDs 12 and 13 on HKLM\SOFTWARE\Classes\appid\*\DllSurrogate, and an offline sweep of the hive for the two GUIDs across the fleet. Because the GUIDs are derived from the C2 URL, they will change with new infrastructure; the generic rule (empty DllSurrogate created outside a software installation) is what carries over to other campaigns, and it should be allowlisted by the signed installer image path rather than by key name. A match on the exact GUIDs is a confirmed infection. Note that the loader also deletes AppID keys as cleanup, so a burst of AppID deletions by a non-installer process is a useful secondary signal.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1112 (Modify Registry) (our mapping)

Sources: “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”, Kaspersky Securelist, Oct. 29, 2026, https://securelist.com/netamloader/121676/ (source article)

Patch My PC ScriptRunner With AppDomainManager Config

The first stage relies on a legitimate binary with a malicious companion file: PatchMyPC-ScriptRunner.exe, started with -updatepackage -applicationid=<GUID> from C:\Windows\SoftwareDistribution\Download\Install\, reads PatchMyPC-ScriptRunner.exe.config, which points the .NET runtime at the signed Microsoft.HostIntegration.Connectors assembly and the Microsoft.ApplicationServer.Caching.DataCacheFactoryConfiguration type. That type reads fabric.config, which hands Resources.resx to System.Resources.ResXResourceSet, and the resx contains a BinaryFormatter payload that ends in XamlReader.Parse(). The detection logic is a process rule for PatchMyPC-ScriptRunner.exe executing from any path under SoftwareDistribution, joined with a file rule for a .exe.config beside it that contains an appDomainManagerAssembly or appDomainManagerType setting, and an image-load rule for Microsoft.HostIntegration.Connectors in a process that isn’t a Host Integration Server component.

Use EDR process, file and module-load telemetry on all Windows endpoints that run Patch My PC or similar third-party patching tools. Sweep 90 days. Legitimate Patch My PC runs come from its own install or cache directories and are launched by the patch-management agent; allowlist on the full signed image path and parent process, not on the file name, because the attacker uses the genuine signed binary and hash blocking it would break patching. The generic version of this lead, any .NET executable started next to a .config that declares an AppDomainManager outside its vendor’s install path, catches the whole AppDomainManager injection technique, not just this loader. A confirmed hit should be escalated, and the folder contents preserved before the loader’s own cleanup removes them.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion / Persistence / Privilege Escalation → T1574.014 (Hijack Execution Flow: AppDomainManager) (our mapping)

Sources: “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”, Kaspersky Securelist, Oct. 29, 2026, https://securelist.com/netamloader/121676/ (source article)

.NET ETW Disabled via COMPlus_ETWEnabled

Before migrating, the first .NET loader uses a WScript.Shell COM instance to set the environment variable COMPlus_ETWEnabled=0, which stops the .NET runtime from emitting the ETW events that EDR products use to see assemblies loaded in memory. In the same stage it patches AMSI by overwriting the start of Console.Clear() with a stub that returns zero and redirecting the AMSI COM object’s Scan vtable slot to it, so content scans report clean. The detection logic is an alert on any process or registry write that sets COMPlus_ETWEnabled (or DOTNET_ETWEnabled) to 0, at the process, user or machine environment level, and on a .NET process whose ETW CLR provider goes silent shortly after start.

Use EDR command-line and environment telemetry, and registry monitoring on HKCU\Environment and HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment for persistent variants. This has a low false-positive rate; expect matches only from developers or performance engineers debugging the runtime, and exclude by host role rather than by process name. AMSI tampering is harder to see directly, but EDR products that monitor writes to amsi.dll or AMSI COM interfaces will often flag it; pairing either signal with the AppDomainManager lead above raises confidence sharply. The technique is common to many .NET loaders and red-team tools, so this lead generalizes well beyond NetamLoader. Treat any hit on a server or government endpoint as likely malicious and investigate the parent process.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1685 (Disable or Modify Tools) (our mapping)

Sources: “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”, Kaspersky Securelist, Oct. 29, 2026, https://securelist.com/netamloader/121676/ (source article)

Dllhost .NET Surrogate Beaconing After Update-Tool Run

The loader uses RPC to create remote COM CLSID ab8902b4-09ca-4bb6-b78d-a8f59079a8d5, abuses it with the same deserialization trick, and loads the final stage into dllhost.exe, where it calls CoLockObjectExternal to keep the surrogate alive. The plugin then waits a random 20 to 40 minutes, polls the C2 every five to six minutes once it gets a valid reply (otherwise checking roughly every 10 minutes over 22 to 28 hours), and exits after about 28 hours via a watchdog. It also wipes %LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\PatchMyPC-ScriptRunner.exe.log and %WINDIR%\Prefetch\PATCHMYPC-SCRIPTRUNNER.EXE-*.pf, and removes lines containing GetExtendedUpdateInfoHandler from files under %WINDIR%\Logs\CmitUpdateAgent\. The detection logic is a sequence: an update-tool process run, then within minutes a new DllSurrogate AppID and a dllhost.exe instance that loads clr.dll, then 20 to 40 minutes later that same dllhost.exe making periodic outbound HTTPS connections to a domain the host has not contacted before, optionally with deletion of the CLR usage log or Prefetch file by a non-system process.

This needs EDR process, module-load, registry and network telemetry joined in a SIEM, plus a baseline of which dllhost.exe AppIDs normally make internet connections on your endpoints (most never do). Run it over at least 30 days and keep the window long enough to cover the 20 to 40 minute delay. Don’t suppress all dllhost.exe network activity as noise; key on surrogate processes with the CLR loaded and on beaconing intervals. Blocking the domain doesn’t address the technique, since new XAML can be delivered from new infrastructure. This sequence generalizes to any COM-surrogate migration by .NET malware. Any confirmed sequence should be escalated to incident response; because the plugin exits after about 28 hours and leaves little on disk, capture memory from the live process if possible.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1559.001 (Inter-Process Communication: Component Object Model); Defense Evasion → T1070.004 (Indicator Removal: File Deletion); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (our mapping)

Sources: “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”, Kaspersky Securelist, Oct. 29, 2026, https://securelist.com/netamloader/121676/ (source article)

Hash Appendix

NetamLoader stages

All hashes come from the source article, which does not label the hash type: the 32-character values are consistent with MD5 and the CAB’s file name is a 40-character value consistent with SHA-1. AlienVault OTX and VirusTotal were not queried in this run, so no SHA-256 values are available.

MD5s
F2458ED133F8D0CA19E22C10F577E98E  # CAB archive -> C:\Windows\SoftwareDistribution\Download\
514AC0D73B8A1B73488EF5E2E55A75C3  # PatchMyPC-ScriptRunner.exe.config -> ...\Download\Install\ (AppDomainManager config)
67E3617F8709D34F806F8E02BADBA8A5  # fabric.config -> ...\Download\Install\
E1DC6F1ED193594F2284BE22AE08DFA4  # Resources.resx -> ...\Download\Install\ (BinaryFormatter payload)
514117D536E347560D049CFE0C609632  # XAML-1 (in memory, decryptor)
9000820D8153C24CD60D53001D3A97B6  # XAML-2 (in memory)
B3C4A635179680EDAFB5D006CF0CFFC6  # XAML-2-1 (in memory, AMSI bypass)
4F28622C5E60C01319BF48CF742FE1A5  # XAML-2-2 (in memory, carries .NET 1 Loader)
AB81564BCB8CA7E710C66832DE747556  # .NET 1 Loader (in memory, cleanup + ETW off + dllhost migration)
C86D53392A87DD3F3E62D62C9B92A9BD  # XAML-3 (in memory, inside dllhost.exe)
CFB8B281BDF5D9390E64B10C312FB2C1  # .NET 2 Plugin (in memory, inside dllhost.exe, C2 client)

SHA1s
e4537a1762fcafd2fd96bfc825bad34f9db9a24d  # CAB archive (file name in SoftwareDistribution\Download)
(not available)  # all other files

SHA256s
(not available)  # all files

Note: PatchMyPC-ScriptRunner.exe and the Microsoft assemblies in the package are legitimate signed binaries; do not block their hashes, which would break patching. Detect the path, the companion config and the parent process instead.

References Appendix

• “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”, Kaspersky Securelist (GReAT), Oct. 29, 2026, https://securelist.com/netamloader/121676/ (source article; infection chain, registry, C2, hashes)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/