NetamLoader: Defending Against Sophisticated .NET Injection in Government Windows 10 Environments

Security researchers at Kaspersky have disclosed a highly sophisticated malware campaign dubbed NetamLoader, actively targeting government organizations across Asia. This threat employs a previously undocumented .NET assembly-loading framework designed to inject malicious code into legitimate Windows 10 processes. The campaign specifically targets a custom Windows 10 build used exclusively by government entities, indicating reconnaissance and victimology focused on high-value government networks.

NetamLoader represents a concerning evolution in .NET-based malware delivery. By leveraging .NET injection techniques, the malware achieves persistence and code execution while evading traditional signature-based defenses. Government agencies and defense contractors operating in Asia should treat this as an active threat requiring immediate attention.

Technical Analysis

Campaign Overview

The NetamLoader campaign demonstrates several hallmarks of advanced threat actor tradecraft:

Target Specificity: The malware exclusively targets a custom Windows 10 build deployed within government environments, suggesting prior reconnaissance and intelligence gathering
Sophisticated Infection Chain: Multiple stages of obfuscation and loading before final payload execution
Novel Framework: Uses a previously undocumented .NET assembly-loading mechanism, indicating custom tool development
Regional Focus: Concentrated targeting of Asian government organizations

Attack Chain

Based on available intelligence, the infection chain proceeds through the following stages:

Initial Access: Likely via spear-phishing or supply-chain compromise (specific vector not yet disclosed)
Loader Deployment: NetamLoader framework is delivered to the target system
.NET Assembly Loading: The loader leverages .NET reflection and assembly loading capabilities to execute malicious code in-memory
Process Injection: Malicious .NET assemblies are injected into legitimate Windows processes, likely targeting .NET Framework host processes
Payload Execution: Final malicious payload executes within the context of trusted processes

Technical Indicators

Key observable behaviors associated with NetamLoader infections include:

Suspicious .NET Assembly Loading: Unusual clr.dll or mscoree.dll activity in non-standard processes
Process Hollowing/Injection: Legitimate processes spawning with unexpected command-line arguments or parent processes
Custom Windows 10 Build Artifacts: The campaign specifically targets government-customized Windows 10 images, suggesting defenders should review baseline deviations
Network Communication: Command and control traffic likely using HTTPS with domain fronting or legitimate service abuse

Exploitation Status

Confirmed Active Exploitation: This is an active, in-the-wild campaign targeting government entities. The sophisticated nature of the tooling and specific targeting of government Windows 10 builds indicates nation-state or advanced persistent threat (APT) involvement.

Detection & Response

SIGMA Rules

YAML

---
title: Suspicious .NET Assembly Loading in Non-Standard Processes
id: 8f4e2a91-3b7c-4d5e-9a1f-6c8d2e4f5a6b
status: experimental
description: Detects potential NetamLoader-style .NET injection by identifying .NET CLR loading in processes that do not typically host .NET assemblies
references:
  - https://thehackernews.com/2026/11/netamloader-malware-targets-government.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.defense_evasion
  - attack.t1055
  - attack.t1620
logsource:
  category: image_load
  product: windows
detection:
  selection_img:
    ImageLoaded|endswith:
      - '\clr.dll'
      - '\mscoree.dll'
      - '\clrjit.dll'
  filter_legitimate:
    Image|endswith:
      - '\powershell.exe'
      - '\w3wp.exe'
      - '\svchost.exe'
      - '\mmc.exe'
      - '\devenv.exe'
      - '\iexplore.exe'
      - '\excel.exe'
      - '\winword.exe'
      - '\outlook.exe'
      - '\msedge.exe'
      - '\chrome.exe'
  condition: selection_img and not filter_legitimate
falsepositives:
  - Custom .NET applications
  - Line-of-business applications
  - Development environments
level: high
---
title: Suspicious Process Creation from .NET Host Processes
id: 2c7f4b1a-8e3d-4a5c-b6d9-1e2f3a4b5c6d
status: experimental
description: Identifies suspicious child processes spawned by .NET Framework host processes, potentially indicating NetamLoader payload execution
references:
  - https://thehackernews.com/2026/11/netamloader-malware-targets-government.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\svchost.exe'
      - '\dllhost.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate application updates
  - System administration tasks
level: medium
---
title: Reflective .NET Assembly Loading via PowerShell
id: 5a9d3c7e-2f1b-4e8a-9c6d-3b5a7f1e4d2c
status: experimental
description: Detects PowerShell commands loading .NET assemblies from non-standard locations or using reflection techniques associated with NetamLoader
references:
  - https://thehackernews.com/2026/11/netamloader-malware-targets-government.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - 'System.Reflection.Assembly'
      - 'LoadFrom'
      - 'LoadFile'
      - 'ReflectionOnlyLoad'
      - '[System.AppDomain]::CurrentDomain.Load'
      - 'Add-Type -Path'
      - 'Add-Type -LiteralPath'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate PowerShell scripts
  - System administration automation
level: medium

KQL Hunting Queries

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious .NET CLR loading in unexpected processes
DeviceImageLoadEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("clr.dll", "mscoree.dll", "clrjit.dll")
| where InitiatingProcessFileName !in~ (
    "powershell.exe", "w3wp.exe", "svchost.exe", "mmc.exe", 
    "devenv.exe", "iexplore.exe", "excel.exe", "winword.exe", 
    "outlook.exe", "msedge.exe", "chrome.exe"
)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, 
    InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| summarize Count = count() by InitiatingProcessFileName, FileName
| order by Count desc

// Hunt for suspicious child processes from potential injection targets
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "svchost.exe", "dllhost.exe")
| where FileName in~ (
    "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", 
    "mshta.exe", "certutil.exe", "bitsadmin.exe", "rundll32.exe"
)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, 
    InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt for PowerShell reflective assembly loading
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any (
    "System.Reflection.Assembly", "LoadFrom", "LoadFile", 
    "ReflectionOnlyLoad", "Add-Type -Path", "Add-Type -LiteralPath"
)
| where ProcessCommandLine !has "Windows\\System32"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, 
    InitiatingProcessFileName, SHA256
| order by TimeGenerated desc

// Hunt for unusual .NET assembly file creation in temp directories
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName endswith ".dll" or FileName endswith ".exe"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\")
| where FileName !has "Microsoft" and FileName !has "Windows"
| project TimeGenerated, DeviceName, FileName, FolderPath, 
    InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

Velociraptor VQL Artifacts

VQL — Velociraptor

-- Hunt for processes with loaded .NET assemblies in unexpected locations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       Exe as ProcessPath
FROM pslist()
WHERE CommandLine =~ 'powershell|wscript|cscript|mshta'
   OR Exe =~ 'Temp|AppData|Public'
ORDER BY CreateTime DESC

-- Hunt for .NET assembly files in suspicious locations
SELECT FullPath, Size, Created, Modified, Accessed
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\Temp\\*.dll')
WHERE Size > 10000
ORDER BY Created DESC

-- Hunt for network connections from .NET host processes
SELECT Pid, Name, LocalAddress, LocalPort, 
       RemoteAddress, RemotePort, State, ProcessPath
FROM netstat()
WHERE Name =~ 'w3wp|svchost|dllhost'
  AND State =~ 'ESTABLISHED'
  AND RemoteAddress !~ '^10\\.|^172\\.16\\.|^192\\.168\\.'
ORDER BY Pid

Remediation Script

PowerShell

# NetamLoader Detection and Hardening Script
# Run with elevated privileges

# Check for suspicious .NET assemblies in temp directories
Write-Host "[+] Scanning for suspicious .NET assemblies in temporary locations..." -ForegroundColor Cyan
$SuspiciousPaths = @(
    "$env:TEMP\*.dll",
    "$env:LOCALAPPDATA\Temp\*.dll",
    "C:\Users\Public\*.dll"
)

foreach ($Path in $SuspiciousPaths) {
    $Files = Get-ChildItem -Path $Path -ErrorAction SilentlyContinue | 
             Where-Object { $_.Length -gt 10KB }
    if ($Files) {
        Write-Host "[!] Found suspicious files in $Path :" -ForegroundColor Yellow
        $Files | Select-Object FullName, Length, CreationTime | Format-Table
    }
}

# Check for unusual .NET CLR loading
Write-Host "[+] Checking for processes with loaded .NET assemblies..." -ForegroundColor Cyan
$DotNetProcesses = Get-Process | Where-Object {
    $_.Modules | Where-Object { $_.ModuleName -match 'clr\.dll|mscoree\.dll' }
}

foreach ($Proc in $DotNetProcesses) {
    Write-Host "[i] Process: $($Proc.Name) (PID: $($Proc.Id))" -ForegroundColor Green
    Write-Host "    Path: $($Proc.Path)"
}

# Enable .NET assembly load auditing
Write-Host "[+] Enabling enhanced .NET assembly load auditing..." -ForegroundColor Cyan
$RegPath = "HKLM:\SOFTWARE\Microsoft\.NETFramework"
$RegName = "EnableAssemblyLoadLogging"

if (-not (Test-Path $RegPath)) {
    New-Item -Path $RegPath -Force | Out-Null
}
Set-ItemProperty -Path $RegPath -Name $RegName -Value 1 -Type DWord
Write-Host "[+] Assembly load logging enabled" -ForegroundColor Green

# Disable PowerShell v2 (legacy attack surface)
Write-Host "[+] Disabling PowerShell v2..." -ForegroundColor Cyan
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -NoRestart -ErrorAction SilentlyContinue
Write-Host "[+] PowerShell v2 disabled" -ForegroundColor Green

# Enable PowerShell Script Block Logging
Write-Host "[+] Enabling PowerShell Script Block Logging..." -ForegroundColor Cyan
$PSLoggingPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $PSLoggingPath)) {
    New-Item -Path $PSLoggingPath -Force | Out-Null
}
Set-ItemProperty -Path $PSLoggingPath -Name "EnableScriptBlockLogging" -Value 1 -Type DWord
Write-Host "[+] Script Block Logging enabled" -ForegroundColor Green

# Check for suspicious network connections from .NET processes
Write-Host "[+] Checking for suspicious network connections..." -ForegroundColor Cyan
$DotNetPIDs = $DotNetProcesses | Select-Object -ExpandProperty Id
$SuspiciousConnections = Get-NetTCPConnection | Where-Object {
    $_.OwningProcess -in $DotNetPIDs -and 
    $_.State -eq 'Established' -and
    $_.RemoteAddress -notmatch '^10\.|^172\.16\.|^192\.168\.|^127\.'
}

if ($SuspiciousConnections) {
    Write-Host "[!] Found suspicious network connections:" -ForegroundColor Red
    $SuspiciousConnections | Select-Object LocalAddress, LocalPort, 
        RemoteAddress, RemotePort, OwningProcess | Format-Table
}

Write-Host "[+] Detection and hardening scan complete" -ForegroundColor Green
Write-Host "[!] Review any suspicious findings above and investigate accordingly" -ForegroundColor Yellow

Remediation and Hardening Recommendations

Immediate Actions

Enhanced Monitoring: Deploy the detection rules and hunting queries provided above to identify potential NetamLoader infections
Threat Hunt: Conduct proactive threat hunting using the VQL artifacts and KQL queries across your environment
Incident Response: If suspicious .NET assembly loading is detected, isolate affected systems and initiate forensic analysis

Long-Term Hardening

Application Control: Implement Windows Defender Application Control (WDAC) or AppLocker policies to restrict .NET assembly execution to trusted paths only
PowerShell Hardening:
- Disable PowerShell v2
- Enable Script Block Logging and Module Logging
- Implement Constrained Language Mode where operationally feasible
.NET Framework Security:
- Enable .NET assembly load auditing
- Monitor for assemblies loaded from non-standard locations
- Consider implementing .NET code integrity policies
Network Segmentation: Isolate government-customized Windows 10 builds from general user populations
Email Security: Enhance email filtering to detect spear-phishing attempts delivering .NET-based payloads
Supply Chain Security: Review third-party software and update mechanisms for potential compromise vectors

Detection Strategy

Implement a defense-in-depth approach:

Layer 1: Email and web gateway filtering to prevent initial delivery
Layer 2: Endpoint detection for suspicious .NET assembly loading
Layer 3: Network monitoring for command and control traffic
Layer 4: Behavioral analytics to identify post-exploitation activities

Conclusion

NetamLoader represents a sophisticated threat specifically targeting government organizations in Asia. The use of custom .NET injection techniques demonstrates the ongoing evolution of APT tradecraft. Organizations must implement comprehensive detection capabilities, proactive threat hunting, and robust hardening measures to defend against this and similar threats.

Security teams should prioritize the deployment of the detection rules and hunting queries provided in this analysis, conduct thorough threat hunts across their environments, and implement the recommended hardening measures to reduce attack surface.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub