NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

NetamLoader is a previously undocumented .NET assembly-loading framework used in a sophisticated infection chain targeting government Windows 10 systems in Asia. The malware is delivered via a malicious CAB file placed in a Windows update directory, leveraging AppDomainManager injection to execute malicious payloads. It uses multiple stages of encoded and compressed XAML and .NET assemblies to load a final plugin that communicates with a command-and-control server, gathers system information, and deletes forensic traces. The attack appears to be a supply chain compromise, though no specific threat actor has been attributed.

AI-extracted · verify before operational use