NetamLoader Malware Uses AppDomainManager Injection on Governments

Executive Summary

Security researchers at Kaspersky have discovered a new, highly sophisticated malware framework dubbed NetamLoader. This malware is being used in a targeted campaign against government entities in Asia. The attack vector appears to be a supply chain compromise, as the malicious payload was found within a Windows cabinet (.cab) file located in a directory for Windows OS update packages. The malware's core component is its use of AppDomainManager injection, a stealthy .NET technique that allows it to execute arbitrary code within the context of a trusted, legitimate process. This method makes detection difficult and is specifically tailored to a custom build of Windows 10 used by the victims. The threat actor behind this campaign has not yet been identified.

Threat Overview

The NetamLoader campaign represents a significant threat due to its sophistication and targeted nature. The malware was discovered in the first half of 2026, targeting an unspecified number of government organizations in Asia. The delivery method—a malicious CAB file in a Windows update path—strongly suggests a supply chain attack, where a trusted software vendor or update mechanism was compromised to push the malware to its targets. The use of a custom Windows 10 build indicates that the attackers have deep knowledge of the victims' environment, allowing them to tailor the attack for maximum effectiveness and evasion.

Technical Analysis

The standout feature of NetamLoader is its use of AppDomainManager injection. This is an advanced living-off-the-land technique that abuses a legitimate feature of the .NET Framework. Here's how it works:

1. The attackers create a malicious .config file for a legitimate .NET application on the target system.
2. This .config file specifies a malicious DLL to be loaded as the AppDomainManager.
3. When the legitimate application starts, the .NET runtime loads this malicious AppDomainManager before the application's actual entry point.
4. The malicious code in the AppDomainManager then executes within the trusted process space of the legitimate application, effectively hijacking it to load the main NetamLoader payload.

This technique is powerful because it does not require creating a new suspicious process and can bypass security controls that rely on process monitoring or traditional signature-based detection. It is conceptually similar to DLL sideloading but operates within the .NET Framework's managed code environment.

MITRE ATT&CK Techniques

• T1199 - Trusted Relationship: The use of a Windows update package points to the compromise of a trusted third-party vendor, a hallmark of a supply chain attack.
• T1574.013 - AppDomainManager: This is the core technique used for persistence and defense evasion, loading malicious code into a legitimate process.
• T1129 - Shared Modules: The malware loads as a shared module within the .NET environment of a trusted application.
• T1059.007 - JavaScript/JScript: While not specified, .NET loaders often use scripting or reflection to execute their payloads.

Impact Assessment

The impact on the targeted government agencies could be severe, including espionage, data theft, and long-term persistent access to sensitive networks. The stealthy nature of NetamLoader means it could remain undetected for long periods, allowing attackers to quietly exfiltrate data. The use of a supply chain vector complicates remediation, as the trust relationship with the software vendor must be re-evaluated and potentially severed. This campaign serves as a reminder of the advanced, tailored threats faced by government organizations from sophisticated, possibly state-sponsored, threat actors.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for NetamLoader and similar threats by looking for:

Detection & Response

1. Monitor .config Files: Use File Integrity Monitoring (FIM) to alert on the creation or modification of .config files for common .NET applications (e.g., InstallUtil.exe, RegAsm.exe). This is a high-fidelity indicator of this technique.
2. Process Monitoring with Command-Line Auditing: Enable process creation logging (Windows Event ID 4688) and monitor for legitimate .NET processes being launched with unusual parent processes or command-line arguments. This aligns with D3FEND's Process Analysis.
3. .NET Logging: Enable and collect .NET runtime logs, which can provide visibility into assembly loads and AppDomain creation, potentially revealing the malicious injection.
4. Behavioral Analysis: Deploy an EDR solution capable of detecting anomalous behaviors within trusted processes, such as a legitimate application making outbound network connections or accessing sensitive files inconsistent with its normal function.

Mitigation

1. Application Control: Implement application control policies, such as Windows Defender Application Control (WDAC), to restrict which DLLs can be loaded by applications. A properly configured policy can prevent the malicious AppDomainManager DLL from being loaded. This is a form of D3FEND's Executable Allowlisting.
2. Supply Chain Security: For government entities, rigorously vet all third-party software and updates. Require vendors to provide signed manifests (e.g., SBOMs) for all software components.
3. System Hardening: Harden systems by removing unnecessary .NET versions and features. Enforce the principle of least privilege to limit the actions a compromised process can take.
4. Endpoint Detection and Response (EDR): A modern EDR is essential for detecting the post-exploitation behavior that follows a successful AppDomainManager injection, as the injection itself is designed to be stealthy.