Cybersecurity researchers have uncovered what they describe as a "highly sophisticated infection chain" aimed at government organizations in Asia, according to a report released by Kaspersky this week. The attack deployed a previously undocumented .NET assembly-loading framework called NetamLoader and targeted a custom Windows 10 build used exclusively by government entities. The intrusion has not been linked to any known threat actor, and it remains unclear whether the hackers compromised more than one system or successfully extracted sensitive information.
The malicious artifact was discovered in the first half of 2026, packaged inside a Windows cabinet archive file that had been placed in a directory storing Windows operating system update packages, Kaspersky said. The campaign is suspected to involve a supply chain attack, in which adversaries compromised a trusted third-party vendor to reach downstream users who depend on its services or software. The archive contained seven files, four of which are legitimate components of Patch My PC, an endpoint management software, while the malicious payload resided in a file called "Resources.resx." This file contained multiple layers of encoded, compressed, or encrypted payloads, including XAML files, .NET assemblies, and JSON data. The infection unfolds in two stages: the execution of a legitimate application serves as the launchpad, abusing AppDomainManager injection to load arbitrary .NET assemblies and ultimately deploy a plugin that communicates with a command-and-control server at "openaigpt4v[.]com." If a valid response is received from the server, the malware pauses for five to six minutes before the next request; otherwise, it waits 22 to 28 hours, checking every 10 minutes to see if the allotted time has elapsed.
Telemetry data gathered by Kaspersky identified a single victim in Asia, with NetamLoader designed to attack a Windows 10 build customized for government-only use. The report notes that although the targeted Asian country was not disclosed, signs suggest it's likely China, as Microsoft offers a bespoke version called Windows 10 China Government Edition specifically for the Chinese government and state-owned entities. Earlier this August, Bloomberg reported that China's Ministry of State Security had ordered some government agencies to stop using the "Government Edition" in favor of Chinese-made Linux distributions as part of an effort to reduce its dependence on foreign technology, citing data security concerns. The malware's final payload is a .NET assembly that gathers system information from Windows Registry, checks if the current host process is legitimate, waits a random jitter delay of 20 to 40 minutes before issuing its first request to the command-and-control server, and then enters a periodic polling loop to fetch an XAML file and execute it.
The attack's sophistication lies in its ability to abuse legitimate software components and hijack .NET Framework's application-domain initialization to achieve code execution, effectively running malicious code inside a legitimate application's process to evade detection. According to Kaspersky, the sample employs AppDomainManager injection, an adversarial technique used to load arbitrary payloads when a .NET application starts, with the end result similar to DLL sideloading. The malware also takes steps to cover its tracks by deleting malicious files extracted from the CAB archive, along with CLR usage logs and Windows system Prefetch cache files. The report concludes that "in today's geopolitical climate, a growing number of countries are building their own core software platforms, including operating systems, databases, middleware, and cloud services, with operating systems often the top priority." The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process, but it also means that each country must protect this entire vast ecosystem on its own, and bringing the operation and maintenance of such a system to maturity is a lengthy process. The discovery highlights the tension between technological sovereignty and the security challenges that come with maintaining custom-built infrastructure, particularly when nation-states seek to reduce reliance on foreign vendors while simultaneously defending against targeted intrusions. Organizations that deploy bespoke operating system builds may face heightened risk if attackers identify and exploit vendor relationships or update mechanisms unique to those environments.