APT used NetamLoader to compromise custom Asian government Windows 10 build
The claim
The authors assert that an unknown APT leveraged the NetamLoader framework to conduct a supply-chain attack against a Windows 10 build used exclusively by Asian government entities.
Published as: “Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia”
So what
The report highlights that even highly controlled, government-specific Windows builds can be compromised through sophisticated .NET/XAML loading techniques.
The five-minute version
The researchers observed a CAB file placed in the Windows SoftwareDistribution folder that, when executed by PatchMyPC-ScriptRunner.exe, triggers a multi-stage loading chain built on XAML and .NET deserialization. By abusing a design flaw in DataCacheFactoryConfiguration, the chain loads malicious XAML payloads that bypass AMSI, establish encrypted C2 communication, and execute a .NET plugin in a separate dllhost.exe process. Evidence comes from Kaspersky telemetry showing a single victim and detailed reverse-engineering of the payloads, but the delivery method and broader impact remain unknown.
What they found 1
- NetamLoader abuses a design flaw in DataCacheFactoryConfiguration to load arbitrary assemblies
“The DataCacheFactoryConfiguration class has a design flaw that can be abused to load arbitrary assemblies. The fabric.config file is meticulously crafted.”
What undercuts it the paper’s own results
- We did not observe how the CAB file was delivered to the victim; we only saw the process PatchMyPC-ScriptRunner.exe running with the following arguments:
- Based on KSN telemetry data, we identified a single victim in Asia.
Stated limits 3
- We did not observe how the CAB file was delivered to the victim; we only saw the process PatchMyPC-ScriptRunner.exe running with the following arguments:
- Based on KSN telemetry data, we identified a single victim in Asia.
- After analyzing the TTPs, code similarities, and infrastructure, we were unable to link the attack to any known APT group.
What’s new here 4
- Discovery of NetamLoader, a multi-stage XAML/.NET loading framework used in a supply-chain style attack
- Exploitation of a design flaw in DataCacheFactoryConfiguration to achieve arbitrary assembly loading via AppDomainManager injection
- Use of XAML payloads to bypass AMSI and load remote code in an isolated AppDomain
- Long-polling, AES-128-CBC encrypt-then-MAC C2 communication with custom key derivation
Artifacts & methods 9
- NetamLoadersystem
- PatchMyPC-ScriptRunner.exeprimitive
- fabric.configprimitive
- Resources.resxprimitive
- XAML-1primitive
- XAML-2primitive
- .NET 1 Loadersystem
- .NET 2 Pluginsystem
- openaigpt4v.com C2 serversystem