[netamloader]

October 30, 2026

• NetamLoader: Kaspersky describes an unknown APT hitting a Windows 10 build customised for Asian governments, starting from a CAB-triggered PatchMyPC-ScriptRunner.exe, using AppDomainManager injection and fabric.config/Resources.resx abuse (ResXResourceSet plus BinaryFormatter.Deserialize with TypeConfuseDelegate) to stage XAML-based .NET payloads with an AMSI bypass, beaconing to a Cloudflare-fronted C2 at openaigpt4v[.]com (Securelist). · Threat Activity & Breaches

in Attackers Go for the Management Plane