Executive Summary
A sophisticated infection chain involving a previously unknown advanced loading framework, NetamLoader, was discovered in early 2026. The malware was delivered via a CAB archive placed in Windows update directories, likely targeting a specialized version of Windows 10 used exclusively by government entities in Asia. The attack demonstrates high technical maturity, utilizing multiple stages of XAML markup to load .NET assemblies and bypass traditional security monitoring.
The technical workflow involves AppDomainManager injection, TypeConfuseDelegate attacks, and complex multi-layered encryption of payloads including XAML templates and .NET plugins. The threat actor remains unattributed, but their focus on sovereignty-focused operating systems suggests a high-stakes espionage motivation. The malware also includes specific features for bypassing AMSI, evading sandboxes through long jitter delays (up to 40 minutes), and cleaning forensic artifacts like CLR usage logs and Prefetch files.
The impact is significant for regional government infrastructure. NetamLoader achieves persistence and stealth by separating its execution from the initial process tree, using RPC to load payloads into legitimate processes like dllhost.exe. This level of tradecraft facilitates long-term access and intelligence gathering while avoiding detection by EDR solutions.