NetamLoader: .NET Assembly-Loading Framework Abusing Microsoft Components in Asian Government Campaign

NetamLoader is an undocumented .NET assembly-loading framework deployed in a multi-stage infection chain targeting custom Windows 10 builds used exclusively by government organizations in Asia. The campaign abuses legitimate Microsoft software components to execute malicious .NET assemblies and DLLs, bypassing endpoint security through trusted-component misuse. Kaspersky GReAT attributed the activity to an undisclosed APT deploying second-stage downloaders and payloads via C2 infrastructure. Persistence is established on hardened government OS images, enabling potential data exfiltration from sensitive networks.

• Incident Overview: Targeted Government Campaign

  • Undocumented .NET assembly-loading framework identified by Kaspersky GReAT researchers.
  • Targets custom Windows 10 government builds exclusive to Asian government entities.
  • Attributed to an undisclosed APT with intelligence collection objectives.
  • Deployment observed on hardened operating systems across Asian government infrastructure.

• Attack Vector: Microsoft Component Abuse

  • Leverages legitimate Microsoft software components for malicious code execution.
  • Multi-stage infection chain delivers NetamLoader and subsequent payloads.
  • Suspected supply-chain attack against hardened government OS images.
  • Initial access tied to trusted component misuse rather than direct exploitation.

• Technical Mechanics: .NET Assembly Loading & Evasion

  • Executes malicious .NET assemblies and DLLs through the assembly-loading framework.
  • Evades endpoint security tools by abusing trusted Microsoft components.
  • Downloads second-stage downloaders and payloads from C2 infrastructure.
  • Enables in-memory execution to avoid disk-based detection.

• Impact: Persistence and Exfiltration Risk

  • Unauthorized malicious code execution on hardened government infrastructure.
  • Persistence established on customized Windows 10 builds.
  • Potential data exfiltration from sensitive government networks in Asia.
  • Additional malware programs deployed post-compromise for extended access.

• Defensive Actions: Detection and Mitigation

  • Monitor for anomalous .NET assembly loading in government environments.
  • Audit legitimate Microsoft component usage for unauthorized execution.
  • Block known C2 infrastructure and investigate supply-chain integrity.
  • Apply application control policies to restrict unauthorized DLL loading.