Unknown APT Deploys NetamLoader via Compromised Patch‑Management Update on Asian Government Windows Builds
What Happened — Researchers at Kaspersky uncovered a sophisticated .NET‑based loader, dubbed NetamLoader, embedded in a CAB archive that was placed in the Windows SoftwareDistribution folder. The archive appears to have been delivered through the legitimate third‑party patch‑management tool Patch My PC. Although the bundled executables are signed by Microsoft and the majority of files are benign, the configuration file uses an AppDomainManager injection technique to load arbitrary .NET assemblies, ultimately executing a malicious XAML payload in an isolated AppDomain. The chain targets a custom Windows 10 image used exclusively by government entities in Asia, suggesting a supply‑chain compromise of the update mechanism. No public attribution has been made, and the delivery method remains unknown.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of supply‑chain risk management and software‑integrity verification, a single VCF control that maps to many frameworks (e.g., NIST CSF 2.0).
Who Is Affected — Government agencies in Asia that rely on the custom Windows build and the Patch My PC update process.
Recommended Actions
- Verify the integrity and provenance of all third‑party update packages (hash checks, signature validation).
- Enforce strict controls over software supply‑chain processes, including continuous monitoring of vendor‑provided binaries.
- Update incident‑response playbooks to include detection of AppDomainManager injection and anomalous CAB archives.
Source: Kaspersky SecureList
Technical Notes
- Attack vector: compromised third‑party dependency (Patch My PC).
- Loader uses AppDomainManager injection, XAML‑based payloads, and AES‑encrypted C2 traffic.
- No CVE is directly referenced; the technique exploits legitimate signed binaries.
Source: Kaspersky SecureList