NETAMLOADERNetamLoader

Complex .NET assembly-loading framework built on XAML markup, reported and named by Kaspersky GReAT, used against a customized Windows 10 build reserved for government entities in Asia in what Kaspersky assesses as a supply-chain attack. A CAB archive placed in the Windows update download folder holds legitimate Patch My PC components and Microsoft-signed assemblies: PatchMyPC-ScriptRunner.exe is hijacked through AppDomainManager injection, a design flaw in the AppFabric DataCacheFactoryConfiguration class loads a crafted Resources.resx, and BinaryFormatter deserialization with TypeConfuseDelegate runs layered AES-encrypted XAML payloads. It patches AMSI through its COM virtual table, disables .NET ETW, wipes Windows update logs, CLR usage logs and Prefetch files, and moves into dllhost.exe through a remote COM object deserialization exploit. Its final .NET plugin polls the C2 (openaigpt4v[.]com, behind Cloudflare) over HTTPS with AES-128-CBC and HMAC, with delays of 20 to 40 minutes before first contact and 22 to 28 hours between polls, and runs downloaded XAML in an isolated AppDomain. Kaspersky saw a single victim in Asia and could not link the attack to any known APT group.