NetamLoader Hid Inside a Real Patching Tool on a Government-Only Windows 10 Build. Here Is What to Hunt For, and the One Domain We Hold.
Kaspersky published details of a loader it calls NetamLoader, found in the first half of 2026 on a government-only build of Windows 10 in Asia. Six of the seven files in its delivery archive were legitimate Patch My PC components. One resource file carried the malicious code. Kaspersky saw a single victim in its telemetry and does not say whether others were hit or whether data was stolen.
How the chain works
A CAB archive was placed in a Windows update directory and extracted to a second directory. Inside were seven files. The launcher, PatchMyPC-ScriptRunner.exe, uses AppDomainManager injection: its .config file names a custom manager, so the runtime loads Microsoft.HostIntegration.Connectors.dll, which reads fabric.config and then loads Resources.resx. Resources.resx holds layers of encoded, compressed or encrypted payloads. The chain bypasses AMSI, Windows' scan interface for scripts, and runs in dllhost.exe.
The .NET loader decrypts the next stage, reports status to its server, deletes the files extracted from the CAB, and clears the CLR usage logs and Prefetch files. The plugin collects system information from the registry, waits a random 20 to 40 minutes before its first request, and then polls for code to run in an isolated AppDomain. After a valid response it pauses five to six minutes. Otherwise it pauses 22 to 28 hours, checking every ten minutes.
Delivery is unknown, and Kaspersky suspects a supply-chain compromise. It attributes the activity to no known actor. The Hacker News infers a Chinese government edition of Windows 10 as the target; that is the article's inference, not Kaspersky's statement.
What to hunt for
From Kaspersky's report as summarized:
- Domain: openaigpt4v.com, the command and control server. It imitates an AI-model name.
- Files: fabric.config, Microsoft.HostIntegration.Connectors.dll, PatchMyPC-Enum.dll, PatchMyPC-Models.dll, PatchMyPC-ScriptRunner.exe, PatchMyPC-ScriptRunner.exe.config and Resources.resx.
- Paths: C:\Windows\SoftwareDistribution\Download\Install\ and a hash-named folder directly under C:\Windows\SoftwareDistribution\Download\.
- Processes: dllhost.exe and PatchMyPC-ScriptRunner.exe.
No hashes, IP addresses, mutexes or registry keys were published, so file names and behavior are what you have.
Ours: dllhost.exe talking to the internet is worth a look anywhere, and more so on a machine where PatchMyPC-ScriptRunner.exe also ran. Because the files that load the malware are real, a hash check against known-good Patch My PC components is the cleaner test. A ScriptRunner config that names a manager nobody installed deliberately is the tell.
What we hold, and what we don't
We hold the one network indicator. We ingested openaigpt4v.com as NetamLoader command and control at confidence 85 on November 1, under the source manual-batch-netamloader-kaspersky-2026-11, and read it back. This is an ingest of Kaspersky's research, not our detection and not a lead. There is no hash to add.
Limits
This rests on The Hacker News' November 1 summary of Kaspersky's Securelist report. We did not read the report itself, and the payload labels in it are the article's internal names, not confirmed on-disk file names.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.