As reported by The Hacker News, Kaspersky has uncovered a sophisticated infection chain targeting government organizations in Asia through a previously undocumented .NET assembly-loading framework called NetamLoader. The operation leveraged a supply-chain compromise involving components from Patch My PC — a widely trusted endpoint management tool — to deliver payloads via AppDomainManager injection into a custom Windows 10 build used exclusively by government entities.

Threat Alert: As reported by The Hacker News, Kaspersky has uncovered a sophisticated infection chain targeting government organizations in Asia through a previously undocumented .NET assembly-loading framework called NetamLoader.

Why This Matters

Three elements of this campaign elevate it beyond routine malware discovery:

Why This Matters
Target specificity: The attackers selected a custom Windows 10 build used only by Asian government agencies. This indicates prior reconnaissance and knowledge of the target environment — a hallmark of deliberate, possibly state-sponsored operations rather than opportunistic criminal activity.
Supply chain pivot: By embedding malicious code alongside legitimate Patch My PC binaries inside a CAB archive placed in Windows Update's download directory, the actors weaponized trust in both the vendor and the OS update mechanism itself.
Detection evasion: AppDomainManager injection executes within a legitimate, signed .NET process. Most EDR solutions that rely on process-level or DLL-load telemetry will see normal application behavior, not malicious code execution.

The .NET Blind Spot

AppDomainManager injection exploits the .NET Framework's initialization sequence — when a managed application starts, the runtime consults a .config file for a custom AppDomainManager type. An attacker who controls that configuration can point the runtime to load arbitrary assemblies before the application's own code runs. The result is code execution inside a trusted, signed process with minimal behavioral anomalies.

While the technique itself is documented in security research and red team tooling, its operational use remains relatively rare — which is precisely what makes it effective. Defenders who have not specifically tuned detection rules for AppDomainManager abuse will likely miss it. The NetamLoader campaign demonstrates that adversaries are actively filling gaps where defenders assume safety from obscurity.

What's particularly notable is the fabric.config mechanism — a second-stage configuration file parsed by the injected DLL. This layered approach adds resiliency and complicates static analysis, as each layer alone appears innocuous.

Who Is at Risk

While the immediate victims are Asian government entities, the exposure surface is broader:

  • Any organization using Patch My PC or similar endpoint management tools in environments where software supply chains are not independently validated
  • Government agencies running custom or hardened OS builds, which may receive less security vendor attention than mainstream configurations
  • Defenders whose EDR coverage does not include .NET runtime injection detection — this is a widespread gap, not unique to the affected entities

Shield53 Recommendations

Immediate Actions

  • Inventory Patch My PC deployments: Identify all systems running Patch My PC components. Verify binary integrity against vendor-published hashes. Any unexpected .config modifications alongside PatchMyPC-ScriptRunner.exe warrant immediate investigation.
  • Scan for AppDomainManager abuse: Search across endpoints for .exe.config files containing appDomainManagerType or appDomainManagerAssembly attributes pointing to unexpected assemblies. Legitimate use is rare — treat any match as suspicious until validated.
  • Audit Windows Update staging: Check C:\Windows\SoftwareDistribution\Download\ for unexpected CAB archives or files dropped into Install\ subdirectories that do not correspond to legitimate Windows Update activity.

Strategic Hardening

  • Validate supply chain integrity: Implement hash-based verification for all third-party software distribution. Require vendors to publish signed manifests or checksums that can be independently validated before deployment.
  • Deploy .NET-specific detection: Ensure EDR or Sysmon configurations capture AppDomainManager initialization events, unusual Assembly.Load calls, and .NET in-memory execution patterns. MITRE ATT&CK technique T1574 (Hijack Execution Flow) covers this class of abuse.
  • Segment and monitor government systems: Custom OS builds should receive heightened monitoring, not reduced attention. Treat non-standard configurations as higher-risk assets requiring additional telemetry.
  • Engage vendors proactively: Contact Patch My PC and similar vendors to confirm their software distribution integrity controls and whether they have issued advisories related to this campaign.

The NetamLoader campaign underscores a persistent truth: attackers continue to exploit the intersection of trusted software, OS-level mechanisms, and defender blind spots. The .NET runtime is a legitimate, pervasive framework — and that makes it an attractive attack surface. Organizations that have not yet extended detection coverage to managed-code injection techniques are operating with an incomplete picture of their endpoint risk.