--- title: Unknown APT uses NetamLoader to attack a Win10 OS... description: Kaspersky researchers uncovered NetamLoader, a complex .NET and XAML-based loading framework used in a targeted attack against a custom Windows 10 build used... canonical: https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia | daily.dev og:description: Kaspersky researchers uncovered NetamLoader, a complex .NET and XAML-based loading framework used in a targeted attack against a custom Windows 10 build used... og:url: https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg og:image: https://api.daily.dev/og/posts/h5SNI6uDG.png og:image:alt: Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia **[Securelist](https://daily.dev/sources/securelist)** · 21 min read · 0 upvotes · 0 comments ## Summary Kaspersky researchers uncovered NetamLoader, a complex .NET and XAML-based loading framework used in a targeted attack against a custom Windows 10 build used only by Asian government entities. The infection starts from a CAB archive placed in the Windows update packages folder, abusing AppDomainManager injection and a vulnerable DataCacheFactoryConfiguration class to trigger a BinaryFormatter deserialization bug. Multiple layered, encrypted XAML and .NET payloads follow, including an AMSI bypass, a COM-based process injection into dllhost.exe, and a final plugin that polls a Cloudflare-hosted C2 every 22 to 28 hours. Kaspersky found a single victim in Asia and could not attribute the attack to any known APT group. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is NetamLoader and how does it infect a system? NetamLoader is a sophisticated .NET and XAML-based malicious loading framework discovered by Kaspersky, used in a targeted attack against a custom Windows 10 build used exclusively by Asian government entities. It starts from a CAB archive placed in the Windows update packages folder, using AppDomainManager injection via PatchMyPC-ScriptRunner.exe.config to abuse a flaw in Microsoft's DataCacheFactoryConfiguration class, triggering a BinaryFormatter deserialization vulnerability that loads layered, encrypted XAML and .NET payloads. _Security teams tracking novel APT loader techniques can follow deep technical breakdowns like this on daily.dev._ ### How does this malware bypass AMSI and EDR detection? The malware patches the AMSI COM object's virtual method table, redirecting its Scan() pointer to a hijacked Console.Clear() function so every scan returns AMSI_RESULT_CLEAN. To evade EDR, it uses RPC to exploit a remote COM object via deserialization and TypeConfuseDelegate, loading its final payload into dllhost.exe, separating the infection chain from its initial process tree and bypassing behavioral monitoring. _Defenders hardening against AMSI bypass and process injection can keep up with new evasion techniques via daily.dev._ ### How often does this malware communicate with its command-and-control server? The malware polls its C2 server every 5 to 6 minutes after a valid response, but falls back to a 22 to 28 hour interval (79200-100800 seconds) if the C2 doesn't respond, checking every 10 minutes to see if the wait has elapsed. It also waits 20-40 minutes before its first connection and exits automatically after about 28 hours if nothing happens, both tactics aimed at evading sandbox analysis. _Threat hunters profiling C2 beaconing patterns can track detailed IOC breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [Inside .NET Loader Analysis: From Malspam to In-Memory Loader](https://daily.dev/posts/inside-net-loader-analysis-from-malspam-to-in-memory-loader-tafajwltg) · Huntress Blog · 4 upvotes · 0 comments - [Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption](https://daily.dev/posts/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption-mq93w1tbj) · BleepingComputer · 0 upvotes · 0 comments - [NightEagle APT targets Russian organizations](https://daily.dev/posts/nighteagle-apt-targets-russian-organizations-iwfyae99j) · Securelist · 0 upvotes · 0 comments - [Cavern Manticore: Exposing Iran-Linked Modular C2 Framework](https://daily.dev/posts/cavern-manticore-exposing-iran-linked-modular-c2-framework-d9buxcnjl) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia","url":"https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg"},"datePublished":"2026-10-29T08:03:51.682Z","dateModified":"2026-10-29T08:04:32.320Z","description":"Kaspersky researchers uncovered NetamLoader, a complex .NET and XAML-based loading framework used in a targeted attack against a custom Windows 10 build used...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fef9ff8db95a769df73d5d71b51e28ec?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fef9ff8db95a769df73d5d71b51e28ec?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":".net,malware","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/unknown-apt-uses-netamloader-to-attack-a-win10-os-customized-for-governments-in-asia-h5sni6udg#faq","mainEntity":[{"@type":"Question","name":"What is NetamLoader and how does it infect a system?","acceptedAnswer":{"@type":"Answer","text":"NetamLoader is a sophisticated .NET and XAML-based malicious loading framework discovered by Kaspersky, used in a targeted attack against a custom Windows 10 build used exclusively by Asian government entities. It starts from a CAB archive placed in the Windows update packages folder, using AppDomainManager injection via PatchMyPC-ScriptRunner.exe.config to abuse a flaw in Microsoft's DataCacheFactoryConfiguration class, triggering a BinaryFormatter deserialization vulnerability that loads layered, encrypted XAML and .NET payloads. Security teams tracking novel APT loader techniques can follow deep technical breakdowns like this on daily.dev."}},{"@type":"Question","name":"How does this malware bypass AMSI and EDR detection?","acceptedAnswer":{"@type":"Answer","text":"The malware patches the AMSI COM object's virtual method table, redirecting its Scan() pointer to a hijacked Console.Clear() function so every scan returns AMSI_RESULT_CLEAN. To evade EDR, it uses RPC to exploit a remote COM object via deserialization and TypeConfuseDelegate, loading its final payload into dllhost.exe, separating the infection chain from its initial process tree and bypassing behavioral monitoring. Defenders hardening against AMSI bypass and process injection can keep up with new evasion techniques via daily.dev."}},{"@type":"Question","name":"How often does this malware communicate with its command-and-control server?","acceptedAnswer":{"@type":"Answer","text":"The malware polls its C2 server every 5 to 6 minutes after a valid response, but falls back to a 22 to 28 hour interval (79200-100800 seconds) if the C2 doesn't respond, checking every 10 minutes to see if the wait has elapsed. It also waits 20-40 minutes before its first connection and exits automatically after about 28 hours if nothing happens, both tactics aimed at evading sandbox analysis. Threat hunters profiling C2 beaconing patterns can track detailed IOC breakdowns like this on daily.dev."}}]} ```