On November 7, 2026, Kaspersky disclosed NetamLoader malware, a campaign aimed at a specialized Windows 10 build used by an Asian government agency. What stands out is not noise but camouflage: the attackers borrowed components of the Patch My PC patch-management tool to run their code. For any IT team that automates software updates, this one is worth a careful read.
How NetamLoader was found
According to Kaspersky's GReAT team, as reported by GenK (citing VTC News), the sample dates back to the first half of 2026. It sat inside a CAB archive in the Windows folder, exactly where the operating system keeps update packages, so it looked unremarkable at a glance.
Inside the archive was PatchMyPC-ScriptRunner.exe along with configuration files and libraries. These are pieces of a legitimate tool, but the attackers added malicious parts alongside them.
Borrowing legitimate software to run malware
When PatchMyPC-ScriptRunner.exe starts, the attackers use a technique called AppDomainManager Injection. Put simply, a genuine .NET application is steered through its config file into loading and running malicious components, while the program itself keeps its familiar name and signature.
The infection then unfolds in layers: components decrypt and unpack several encoded blobs, then load modules one by one to finish the setup. Splitting the work this way makes static signature detection much harder.
Evading detection: AMSI, dllhost.exe and cleaned-up traces
NetamLoader does more than hide at launch. It also works to stay hidden afterwards:
- It disables or tampers with AMSI (Antimalware Scan Interface), the Windows mechanism that lets security products inspect code as it runs.
- It moves into dllhost.exe, a legitimate Windows process, so its activity blends in with normal system behavior.
- It deletes traces, including .NET activity logs and Windows Prefetch cache data, which complicates post-incident investigation.
Once deployed, the malware contacts a command-and-control (C2) server to receive instructions or download more code. Kaspersky says it is configured to wait 20 to 40 minutes before the first connection. If it gets no valid reply, it may sleep for 22 to 28 hours before trying again. That sparse pattern helps keep network traffic from looking unusual in short monitoring windows.
Scope is unclear, and Patch My PC is not reported as compromised
The news deserves a measured reading. Kaspersky has identified only one affected system in Asia, running a customized Windows 10 version built for government bodies. The country and the targeted organization were not disclosed.
There is not enough data to judge how far the infection spread, and no evidence yet that sensitive data was stolen. Researchers suspect a software supply chain angle, but they found no sign that Patch My PC's developer or its distribution system was breached. In other words, the tool was abused; nothing says it was poisoned at the source.
Why software teams should care
The core lesson is that the line between trusted software and abused software is thin. Admin tools, update scripts and installers often run with high privileges and sit on allowlists in security products. Attackers know this and aim straight at that gap.
For operations teams, the question changes: not only "is this process legitimate?" but also "where is it running from, who launched it, and should it be talking to the internet?" We saw a similar theme in recent cases such as the DreamHost breach that exposed sessions and customer emails, where a flaw was quietly exploited for months. (That post is in Vietnamese.)
What to do now
Kaspersky and the original report stress extending protection from individual machines to the whole software ecosystem. IT teams can start with this checklist:
- Verify the origin and integrity of update packages before deploying them; do not trust every file just because it sits in a system folder.
- Allow software-management tools to run only from approved locations, for example with path-based allowlists.
- Monitor unusual behavior of legitimate processes, such as dllhost.exe making outbound connections or .NET tools loading unfamiliar libraries.
- Watch connections to external servers, including very infrequent ones with long delays.
- Review .config files shipped with .NET applications, since that is the hook used in AppDomainManager Injection.
Pair this with basics such as staff awareness; our Vietnamese guide on recognizing phishing emails and messages is a good start. For developers, patching dependencies promptly matters just as much, as in the case of Next.js fixing two critical RCE flaws.
Conclusion
NetamLoader shows attackers increasingly using your own admin tools as stepping stones rather than bringing along unfamiliar tools that are easy to block. Only one case is confirmed and the damage is unclear, but controlling where tools run, watching process behavior and tracking outbound connections are all worth doing now.
If your company needs to review its software update process or build systems that are secure by design, contact the Besoft team for advice.
Sources
- GenK / VTC News, "Mã độc mới nhắm vào hệ thống Windows của cơ quan chính phủ tại châu Á", November 7, 2026: https://genk.vn/ma-doc-moi-nham-vao-he-thong-windows-cua-co-quan-chinh-phu-tai-chau-a-16526110717140312.chn
- Original research: Kaspersky GReAT (as cited in the article above).
