Ethical Hacking News
A highly sophisticated supply chain attack has been discovered targeting government organizations in Asia, using a previously undocumented .NET assembly-loading framework codenamed NetamLoader. The attack, which involves the deployment of malicious software via a trusted third-party vendor, has raised significant concerns among cybersecurity experts. In this article, we will explore the details of the NetamLoader malware and the supply chain attack that was used to deploy it, and discuss the implications of the attack and the steps that organizations can take to prevent similar attacks in the future.
The NetamLoader malware is a sophisticated supply chain attack targeting government organizations in Asia. The attack uses a previously undocumented .NET assembly-loading framework to load arbitrary .NET assemblies. The malware is packaged inside a Windows cabinet archive (CAB) file and executed via Patch My PC software. The attack bypasses security controls and steals sensitive information. The attack highlights the importance of supply chain security and the need for organizations to implement robust security measures.
The recent disclosure of the NetamLoader malware by Kaspersky has shed light on a highly sophisticated supply chain attack targeting government organizations in Asia. The attack, which involves the deployment of a previously undocumented .NET assembly-loading framework codenamed NetamLoader, has been described as a "highly sophisticated infection chain" that has raised significant concerns among cybersecurity experts.
According to Kaspersky, the NetamLoader malware was detected in the first half of 2026, packaged inside a Windows cabinet archive (CAB) file placed in a directory that stores Windows operating system update packages. The malware is believed to have been deployed via a supply chain attack, in which bad actors compromised a trusted third-party vendor to gain access to downstream users who rely on its services or software.
The supply chain attack is a complex and targeted attack that involves compromising a trusted third-party vendor, such as a software company or a hardware manufacturer, to gain access to its products or services. In this case, the attack is believed to have been carried out by injecting a malicious .NET assembly into a legitimate software package, which was then distributed to government organizations in Asia.
The NetamLoader malware is a highly sophisticated piece of malware that uses a combination of techniques to evade detection and achieve its goals. The malware uses a previously undocumented .NET assembly-loading framework to load arbitrary .NET assemblies, which are then used to execute malicious code. The malware also uses a combination of encryption and compression to encode its payloads, making it difficult for security software to detect.
The attack has not been attributed to any known threat actor or group, and it is not clear if the intrusion compromised more than one system and allowed the hackers to steal any sensitive information. However, the use of a supply chain attack to deploy the malware raises significant concerns about the security of government systems and the potential for future attacks.
The attack also highlights the importance of supply chain security and the need for organizations to implement robust security measures to protect their software and hardware. The use of a trusted third-party vendor to supply software or hardware can provide a false sense of security, but it can also create vulnerabilities that can be exploited by attackers.
In this article, we will explore the details of the NetamLoader malware and the supply chain attack that was used to deploy it. We will also discuss the implications of the attack and the steps that organizations can take to prevent similar attacks in the future.
The infection chain of the NetamLoader malware is as follows:
1. The malware is packaged inside a Windows cabinet archive (CAB) file placed in a directory that stores Windows operating system update packages.
2. The CAB file is executed, which launches the Patch My PC software.
3. The Patch My PC software executes a payload that uses AppDomainManager injection to load arbitrary .NET assemblies.
4. The .NET assemblies are used to execute malicious code, which is designed to bypass security controls and steal sensitive information.
The payloads used by the NetamLoader malware include:
* XAML-1, a loader for an embedded payload, XAML-2.
* XAML-2 initializes the second stage of the attack chain by loading two compressed and Base64-encoded XAML files: XAML-2-1 and XAML-2-2.
* XAML-2-1 is used to bypass Antimalware Scan Interface (AMSI).
* XAML-2-2 contains two parts: a .NET module (aka .NET 1 Loader) and a JSON data payload (aka JSON-1).
* JSON-1 contains two components: JSON-1-c, which stores command-and-control (C2) server configuration, and JSON-1-p, which contains a Base64-encoded file (.NET 2 Plugin) and a collection of compressed, encrypted XAML templates used to build XAML-3.
* XAML-3 is the XAML payload that runs within "dllhost.exe" and is designed to decode, decompress, and load .NET 2 Plugin.
* .NET 2 Plugin is a .NET assembly that loads the C2 configuration, gathers system information from Windows Registry, checks if the current host process is "dllhost.exe," waits a random jitter delay of 20-40 minutes before issuing its first request to the C2 server ("openaigpt4v[.]com"), and enters into a periodic polling loop to fetch an XAML file and execute it in an isolated AppDomain.
The attack has not been attributed to any known threat actor or group, and it is not clear if the intrusion compromised more than one system and allowed the hackers to steal any sensitive information. However, the use of a supply chain attack to deploy the malware raises significant concerns about the security of government systems and the potential for future attacks.
In conclusion, the NetamLoader malware and the supply chain attack that was used to deploy it highlight the importance of supply chain security and the need for organizations to implement robust security measures to protect their software and hardware. The attack also highlights the sophistication and complexity of modern malware, and the need for organizations to stay vigilant and proactive in protecting their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/NetamLoader-Malware-A-Sophisticated-Supply-Chain-Attack-on-Government-Windows-10-Systems-in-Asia-ehn.shtml
https://thehackernews.com/2026/11/netamloader-malware-targets-government.html
Published: Sun Nov 1 02:24:40 2026 by llama3.2 3B Q4_K_M
