Kaspersky tadqiqotchilari XAML belgilash asosida qurilgan .NET yuklash tizimi — NetamLoader ni aniqlashdi.
Bu faqat Osiyo hukumat organlari tomonidan ishlatiladigan maxsus Windows tuzilmasiga ta'minot zanjiri hujumi bo'lib ko'rinadi. Hech qanday ma'lum APT guruhi bilan bog'lanmagan.
Kaspersky Security Network C:\Windows\SoftwareDistribution\Download ichidagi CAB arxivida joylashgan .config faylini aniqladi, u AppDomainManager in'ektsiyasi orqali ixtiyoriy .NET yig'ilmalarini yuklaydi. CAB tarkibining aksariyati haqiqiy Patch My PC komponentlari edi va in'ektsiya qilingan yig'ilmalar Microsoft imzolangan edi. Faqat Resources.resx zararli edi.
Kaspersky texnik tadqiqotiga ko'ra, PatchMyPC-ScriptRunner.exe Microsoft.HostIntegration.Connectors ga ishora qiluvchi maxsus config faylini yuklaydi. DataCacheFactoryConfiguration klassi keyin fabric.config ni o'qiydi, u Resources.resx ni tahlil qiladi. Bu fayl Base64 BinaryFormatter obyektini o'z ichiga oladi. U TypeConfuseDelegate deserializatsiya hujumini ishga tushiradi va birinchi XAML yuklamasini ishga tushirish uchun XamlReader.Parse() ni chaqiradi.
XAML-1 AES kalitini xostning buyruq satrining SHA-256 xeshidan hosil qiladi va XAML-2 ni shifrdan ochadi. Agar shifrdan ochish muvaffaqiyatsiz bo'lsa, jarayon jimgina to'xtaydi. XAML-2 yana ikkita komponentni ochadi: XAML-2-1, u CAmsiAntimalware::Scan ko'rsatkichini o'zgartirilgan Console.Clear() ga yo'naltirish orqali AMSI ni buzadi, shunda har bir tekshiruv toza deb qaytadi; va XAML-2-2, u .NET 1 Loader va uning JSON C2 konfiguratsiyasini yetkazadi.
Loader yangilanish yozuvlari, CLR foydalanish jurnallari va Prefetch fayllarini o'chiradi. Shuningdek, u CmitUpdateAgent jurnallaridan GetExtendedUpdateInfoHandler yozuvlarini olib tashlaydi, bu maxsus hukumat Windows tuzilmasiga ishora qilishi mumkin.
Keyin u RPC orqali yaratilgan COM obyektidan foydalanib, XAML-3 ni dllhost.exe ichida ishga tushiradi, bu yuklamani asl jarayon daraxtidan ajratib, EDR dan qochadi. Bu joriy yilda ko'rilgan boshqa AMSI dan qochadigan loaderlarga o'xshaydi.
Dastlabki bosqich infektsiya ish oqimi (Rasm manbai: securelist)
Yakuniy plagin birinchi aloqa oldidan 20–40 daqiqa kutadi, bu sandboxlarni yengadi. Keyin u C2 bilan har 5–6 daqiqada, yoki muvaffaqiyatsizlikdan keyin har 22–28 soatda so'rov yuboradi.
Trafik AES-128-CBC va HMAC-SHA256 dan foydalanadi, plagin esa har qanday sertifikatni qabul qiladi. Yuklab olingan XAML izolyatsiya qilingan AppDomain da ishlaydi. Kuzatuvchi taymer jarayonni taxminan 28 soatdan keyin to'xtatadi.
Dinamik XAML arxitektura diagrammasi (Rasm manbai: securelist)
C2 openaigpt4v[.]com, Cloudflare orqasida 104.18.14[.]219 da joylashgan. Kaspersky Osiyoda bitta jabrlanuvchini ko'rdi va kengroq hukumat yo'nalishini taxmin qiladi.
Himoyachilar .NET bajariladigan fayllar yonida, ayniqsa SoftwareDistribution\Download\Install ichida kutilmagan .config fayllarini kuzatishi kerak. Shuningdek, AMSI buzilishi va COM orqali ishga tushirilgan dllhost.exe ga e'tibor qaratish lozim.
Yana bir yangilanish kanali suiiste'mol holati sifatida, ishonchli yangilanish ish oqimlari tobora jozibador nishonga aylanmoqda. To'liq texnik tafsilotlar Kaspersky ning NetamLoader hisobotida.
Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup.
It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it.
Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load arbitrary .NET assemblies. The file sat inside a CAB archive in C:\Windows\SoftwareDistribution\Download.
Most of the CAB contents were legitimate Patch My PC components, and the injected assemblies were Microsoft-signed. Only Resources.resx was malicious.
Extracted Archive Directory Contents (Image Source:securelist)
According to technical research published by Kaspersky, PatchMyPC-ScriptRunner.exe loads a crafted config file that points to Microsoft.HostIntegration.Connectors.
The DataCacheFactoryConfiguration class then reads fabric.config, which parses Resources.resx. That file holds a Base64 BinaryFormatter object. It triggers a TypeConfuseDelegate deserialization attack and calls XamlReader.Parse() to run the first XAML payload.
XAML-1 derives an AES key from the SHA-256 hash of the host’s command line and decrypts XAML-2. If decryption fails, the process exits silently. XAML-2 unpacks two further components: XAML-2-1, which hijacks AMSI by redirecting the CAmsiAntimalware::Scan pointer to a patched Console.Clear() so every scan returns clean, and XAML-2-2, which delivers the .NET 1 Loader and its JSON C2 configuration.
The loader erases update records, CLR usage logs and Prefetch files. It also strips GetExtendedUpdateInfoHandler entries from CmitUpdateAgent logs, which may point to the custom government Windows build.
It then uses an RPC-created COM object to launch XAML-3 inside dllhost.exe, separating the payload from the original process tree to evade EDR. This resembles other AMSI-evading loaders seen this year.
Initial Stage Infection Workflow (Image Source: securelist)
The final plugin waits 20–40 minutes before first contact, which defeats sandboxes. It then polls its C2 every 5–6 minutes, or every 22–28 hours after a failure.
Traffic uses AES-128-CBC with HMAC-SHA256, and the plugin accepts any certificate. Downloaded XAML runs in an isolated AppDomain. A watchdog timer terminates the process after about 28 hours.
Dynamic XAML Architecture Diagram (Image Source: securelist)
The C2 is openaigpt4v[.]com, behind Cloudflare at 104.18.14[.]219. Kaspersky saw one victim in Asia and infers a wider government focus.
Defenders should watch for unexpected .config files beside .NET executables, especially in SoftwareDistribution\Download\Install. They should also alert on AMSI tampering and dllhost.exe launched through COM.
As another update-channel abuse case shows, trusted update workflows are an increasingly attractive target. Full technical details are in Kaspersky’s NetamLoader report.