---
title: Hunt: NetamLoader hid in the Windows update download folder and used AppDomainManager injection with Microsoft-signed .NET assemblies to load XAML payloads on a government-only Windows 10 build in Asia | ctxsec
url: https://ctxsec.com/items/hunt-netamloader-appdomainmanager-patchmypc-scriptrunner
description: ""
status: "vendor research (Kaspersky GReAT, Oct 29); no attribution; Kaspersky did not see how the files were delivered"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-netamloader-appdomainmanager-patchmypc-scriptrunner.md)

vendor research (Kaspersky GReAT, Oct 29); no attribution; Kaspersky did not see how the files were delivered

2026-10-29

### Hunt: NetamLoader hid in the Windows update download folder and used AppDomainManager injection with Microsoft-signed .NET assemblies to load XAML payloads on a government-only Windows 10 build in Asia

Kaspersky says the chain strongly suggests a supply-chain attack on a custom Windows build used only by government entities in Asia, but it has not attributed it to a known group and did not observe delivery. The sample surfaced in the first half of 2026.

- **Where:** a CAB archive in `C:\Windows\SoftwareDistribution\Download\` extracted to `...\Download\Install\`. Most files were legitimate Patch My PC components and Microsoft-signed assemblies; only `Resources.resx` carried malicious content.
- **How it runs:** `PatchMyPC-ScriptRunner.exe -updatepackage -applicationid=...` loads a side-by-side `PatchMyPC-ScriptRunner.exe.config` whose `appDomainManagerType` points at AppFabric's `DataCacheFactoryConfiguration` in `Microsoft.HostIntegration.Connectors`. That class reads a crafted `fabric.config` which instantiates `ResXResourceSet` over the .resx, unpacking layered XAML and .NET stages. A later plugin runs downloaded XAML in a throwaway AppDomain via a delegate swapped to `XamlReader.Parse()`, and C2 traffic uses AES-CBC with HMAC-SHA256.
- **Detections:** HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, Trojan.Script.Agent.*.

**Hunt:** alert on any `*.exe.config` that sets `appDomainManagerType` or `appDomainManagerAssembly` outside known software, on `fabric.config` or `.resx` files next to executables in `SoftwareDistribution\Download`, and on patch-tool runners launched from that folder. This is a technique writeup, not evidence that Patch My PC itself was compromised.

Sources: [Kaspersky Securelist (GReAT): Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia (Oct 29)](https://securelist.com/netamloader/121676/)