{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/netamloader/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows 10 China Government Edition"],"_cs_severities":["high"],"_cs_tags":["netamloader","malware","supply-chain",".net-injection","windows-security"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eNetamLoader is a sophisticated, previously undocumented .NET assembly-loading framework identified by Kaspersky. The malware targets custom Windows 10 builds (likely Windows 10 China Government Edition) used by government entities in Asia. It achieves code execution through AppDomainManager injection, hijacking the initialization process of legitimate applications. The malware was observed packaged within Windows cabinet (CAB) archives placed in system update directories, suggesting a potential supply chain compromise of trusted third-party software.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDelivery of a malicious CAB archive to the victim machine, specifically within 'C:\\Windows\\SoftwareDistribution\\Download' paths.\u003c/li\u003e\n\u003cli\u003eExtraction of contents into 'C:\\Windows\\SoftwareDistribution\\Download\\Install'.\u003c/li\u003e\n\u003cli\u003eExecution of the legitimate process 'PatchMyPC-ScriptRunner.exe', which parses a malicious 'PatchMyPC-ScriptRunner.exe.config' file.\u003c/li\u003e\n\u003cli\u003eInitiation of AppDomainManager injection to load 'Microsoft.HostIntegration.Connectors.dll'.\u003c/li\u003e\n\u003cli\u003eParsing of 'fabric.config' by the DLL to load the 'Resources.resx' file containing encoded and encrypted payloads.\u003c/li\u003e\n\u003cli\u003eMulti-stage decryption and loading of XAML and .NET modules, including XAML-2-1 for AMSI bypass.\u003c/li\u003e\n\u003cli\u003eExecution of XAML-3 within 'dllhost.exe' and final loading of the .NET 2 Plugin.\u003c/li\u003e\n\u003cli\u003eDeployment of a periodic C2 polling loop to 'openaigpt4v.com' for further payload retrieval and execution in isolated AppDomains.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems containing Windows 10 China Government Edition or specialized government Windows builds.\u003c/li\u003e\n\u003cli\u003eMonitor directory paths 'C:\\Windows\\SoftwareDistribution\\Download' for the presence of unexpected CAB archives or unauthorized file extractions into 'Install' subdirectories.\u003c/li\u003e\n\u003cli\u003eImplement strict process execution policies for 'PatchMyPC-ScriptRunner.exe' and ensure hashes match known legitimate versions from the vendor.\u003c/li\u003e\n\u003cli\u003eBlock communication with 'openaigpt4v.com' at the network perimeter.\u003c/li\u003e\n\u003cli\u003eAudit .NET configuration files (.config) in sensitive directories for unexpected 'AppDomainManager' settings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T08:57:47Z","date_published":"2026-11-01T08:57:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-netamloader-windows/","summary":"An unidentified threat actor is using a multi-stage .NET assembly-loading framework called NetamLoader to target government-specific Windows 10 builds via AppDomainManager injection and supply chain compromises.","title":"NetamLoader: Multi-stage .NET injection malware targeting Windows 10","url":"https://feed.craftedsignal.io/briefs/2026-11-netamloader-windows/"}],"language":"en","title":"CraftedSignal Threat Feed - Netamloader","version":"https://jsonfeed.org/version/1.1"}