Kaspersky has documented a .NET loading framework it calls NetamLoader, found in the first half of 2026 inside a Windows cabinet archive sitting in the SoftwareDistribution download directory.
That location matters. It is where Windows keeps update packages, so a file that lives there attracts less scrutiny than one dropped into a user folder. The target was a custom Windows 10 build reserved for government entities in Asia. The country was not named, though Microsoft offers a China Government Edition and that is the likeliest fit.
Legitimate files, one poisoned resource
The CAB held seven files. Four are genuine components of Patch My PC, an endpoint management tool, including PatchMyPC-ScriptRunner.exe. The only malicious piece was Resources.resx.
Execution starts when ScriptRunner runs and its .config file triggers AppDomainManager injection, a technique that hijacks .NET’s application-domain initialization to run arbitrary assemblies. That loads a Microsoft connector DLL, which parses fabric.config and pulls in Resources.resx, where layered XAML and JSON payloads wait.
A staged chain follows: one XAML loader pulls a second, which brings in an AMSI bypass and a .NET loader. A final plugin runs inside dllhost.exe, waits a random 20 to 40 minutes, then polls a command server at openaigpt4v[.]com and deletes the CAB-extracted files, CLR usage logs and Prefetch entries on its way.
What to do about it
Kaspersky’s telemetry covers a single victim and no attribution, and it is unclear whether data was taken. The suspected route in is a compromised third-party vendor. Hunt for unexpected CAB archives under SoftwareDistribution and audit AppDomainManager configuration in managed .NET applications.
