Kiberxavfsizlik tadqiqotchilari Osiyodagi hukumat tashkilotlarini nishonga olgan "yuqori darajada murakkab infeksiya zanjiri" deb ta'riflangan faoliyat tafsilotlarini e'lon qildi.
Kaspersky bu hafta e'lon qilgan ma'lumotlarga ko'ra, ushbu faoliyat faqat Osiyodagi hukumat tashkilotlari tomonidan ishlatiladigan maxsus Windows 10 qurilmasini nishonga olgan va avval hujjatlashtirilmagan .NET yig'ilish-yuklash tizimi — NetamLoader deb nomlangan — joylashtirilishini o'z ichiga oladi.
Hujum hech qanday ma'lum tahdid aktori yoki guruhga bog'lanmagan. Shuningdek, bu kirish bir nechta tizimni buzganmi va xakerlar har qanday maxfiy ma'lumotni o'g'irlaganmi, aniq emas.
Rossiya kiberxavfsizlik kompaniyasi artefakt 2026-yilning birinchi yarmida aniqlanganini, Windows operatsion tizimi yangilanish paketlarini saqlaydigan katalogga joylashtirilgan Windows kabinet arxivi (CAB) fayli ichida qadoqlanganini aytdi.
Operatsiya ta'minot zanjiri hujumini o'z ichiga olgan deb gumon qilinmoqda, bunda yomon niyatli shaxslar ishonchli uchinchi tomon sotuvchini buzib, uning xizmatlari yoki dasturiy ta'minotiga tayanadigan quyi foydalanuvchilarga kirish huquqini qo'lga kiritgan.
Ko'rib chiqilayotgan namuna ".config" faylini o'z ichiga oladi, u AppDomainManager in'ektsiyasidan foydalanib ixtiyoriy .NET yig'ilishlarini yuklaydi. AppDomainManager in'ektsiyasi — .NET ilovasi ishga tushganda .NET Framework'ning AppDomainManager mexanizmini o'g'irlab, ixtiyoriy yuklamalarni yuklash uchun ishlatiladigan dushman texnikasi.
Boshqacha aytganda, bu yondashuv .NET Framework'ning ilova domeni ishga tushirishini nishonga olib, kod bajarilishini ta'minlaydi. Yakuniy natija DLL sideloading bilan bir xil: qonuniy ilova jarayoni ichida zararli kodni ishga tushirish va shu orqali radar ostida qolish.
Kaspersky ma'lumotiga ko'ra, .config faylini o'z ichiga olgan CAB arxivi quyidagi yo'lda joylashtirilgan: "C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24," uning mazmuni esa "C:\Windows\SoftwareDistribution\Download\Install\" ga chiqarib tashlangan.
Infeksiya zanjiri: 1-bosqich
CAB arxivi uchun aniq yetkazib berish vositasi noma'lum. Arxivda yettita fayl mavjud, ulardan to'rttasi Patch My PC — yakuniy nuqta boshqaruv dasturiy ta'minotining qonuniy komponentlari:
- fabric.config
- Microsoft.HostIntegration.Connectors.dll
- PatchMyPC-Enum.dll
- PatchMyPC-Models.dll
- PatchMyPC-ScriptRunner.exe
- PatchMyPC-ScriptRunner.exe.config
- Resources.resx
"Resources.resx" dan tashqari hech bir fayl zararli kodni o'z ichiga olmaydi. Infeksiya zanjiri quyidagicha ikki bosqichli jarayon sifatida amalga oshadi:
- "PatchMyPC-ScriptRunner.exe" bajarilishi bir nechta yuklamalar uchun ishga tushirish maydoni bo'lib xizmat qiladi. U AppDomainManager in'ektsiyasidan foydalanib "PatchMyPC-ScriptRunner.exe.config" ni tahlil qiladi, natijada "Microsoft.HostIntegration.Connectors.dll" bajariladi.
- Yuklangach, "Microsoft.HostIntegration.Connectors.dll" xuddi shu katalogda joylashgan "fabric.config" ni topadi va uning mazmunini tahlil qilib "Resources.resx" ni yuklaydi.
- "Resources.resx" XAML fayllari, .NET yig'ilishlari va JSON ma'lumotlari kabi kodlangan, siqilgan yoki shifrlangan yuklamalarning "bir nechta qatlamlari"ni o'z ichiga oladi, ular komponent tomonidan dekodlanadi va yuklanadi.
Infeksiya zanjiri: 2-bosqich
Ushbu yuklamalarning qisqacha tavsifi quyida keltirilgan:
- XAML-1 — o'rnatilgan yuklama, XAML-2 uchun yuklovchi.
- XAML-2 hujum zanjirining ikkinchi bosqichini ishga tushiradi, ikkita siqilgan va Base64 bilan kodlangan XAML faylini — XAML-2-1 va XAML-2-2 — yuklaydi. XAML-2-1 Antimalware Scan Interface (AMSI) ni chetlab o'tish uchun ishlatiladi.
- XAML-2-2 ikkita qismdan iborat: .NET moduli (ya'ni .NET 1 Loader) va JSON ma'lumot yuklamasi (ya'ni JSON-1).
- JSON-1 — ikkita komponentni o'z ichiga olgan JSON yuklamasi: JSON-1-c, u buyruq-va-boshqaruv (C2) server konfiguratsiyasini saqlaydi, va JSON-1-p, u Base64 bilan kodlangan fayl (.NET 2 Plugin) va XAML-3 ni qurish uchun ishlatiladigan siqilgan, shifrlangan XAML shablonlari to'plamini o'z ichiga oladi.
- XAML-2-2 .NET 1 Loader ni yuklaydi, u esa XAML-3 ni dekodlash, yig'ish va yuklash, C2 serveriga holat haqida xabar berish, CAB arxividan chiqarilgan zararli fayllarni, CLR foydalanish jurnallarini va Windows tizimi Prefetch kesh fayllarini o'chirish orqali izlarni yopish vazifasini bajaradi.
- XAML-3 — "dllhost.exe" ichida ishlaydigan va .NET 2 Plugin ni dekodlash, siqishdan chiqarish va yuklash uchun mo'ljallangan XAML yuklamasi.
- .NET 2 Plugin — C2 konfiguratsiyasini yuklaydigan, Windows Registry'dan tizim ma'lumotlarini to'playdigan, joriy xost jarayoni "dllhost.exe" ekanligini tekshiradigan, C2 serveriga ("openaigpt4v[.]com") birinchi so'rovni yuborishdan oldin 20-40 daqiqa tasodifiy kechikish kutadigan va XAML faylini olish va uni alohida AppDomain'da bajarish uchun davriy so'rov sikliga kiradigan .NET yig'ilishi.
"Agar C2'dan haqiqiy javob olinsa, sikl keyingi so'rovgacha 5-6 daqiqa to'xtaydi; aks holda, u 22-28 soat to'xtaydi va har 10 daqiqada belgilangan vaqt o'tganini tekshiradi," deb tushuntirdi Kaspersky.
Kaspersky tomonidan to'plangan telemetriya ma'lumotlari Osiyoda bitta qurbonni aniqlagan, NetamLoader esa hukumat uchun maxsus moslashtirilgan Windows 10 qurilmasini nishonga olish uchun mo'ljallangan. Nishonga olingan Osiyo davlati ochiq aytilmagan bo'lsa-da, bu ehtimol Xitoy ekanligi haqida ishoralar bor, chunki Microsoft Xitoy hukumati va davlatga tegishli tashkilotlar uchun maxsus Windows 10 China Government Edition deb nomlangan versiyasini taklif qiladi.
Shu yil avgust oyida Bloomberg Xitoy Davlat xavfsizlik vazirligi ba'zi hukumat idoralariga xorijiy texnologiyaga bog'liqlikni kamaytirish maqsadida "Government Edition" dan foydalanishni to'xtatib, Xitoyda ishlab chiqarilgan Linux tarqatmalariga o'tishni buyurganini xabar qilgan edi.
"Pekinning bu ko'rsatmasi ma'lumotlar xavfsizligi bilan bog'liq xavotirlar natijasida berilgan," deb aytgan Bloomberg, "bu masala bilan tanish shaxslarga" tayanib. O'sha paytda qo'shimcha tafsilotlar e'lon qilinmagan.
"Bugungi geosiyosiy iqlimda tobora ko'proq davlatlar o'zlarining asosiy dasturiy ta'minot platformalarini, jumladan operatsion tizimlar, ma'lumotlar bazalari, o'rta qatlam dasturlari va bulut xizmatlarini qurmoqda, operatsion tizimlar ko'pincha eng yuqori ustuvorlik hisoblanadi," deb xulosa qildi Kaspersky.
"Afzallik shundaki, har bir davlat o'z operatsion tizimlarining ishlab chiqilishi, ishlashi va yangilanishini nazorat qiladi, bu esa butun jarayon ustidan to'liq avtonomiyani ta'minlaydi. Boshqa tomondan, bu har bir davlat ushbu ulkan ekotizimni o'zi himoya qilishi kerakligini ham anglatadi. Bunday tizimni ishlatish va texnik xizmat ko'rsatishni yetuklik darajasiga yetkazish uzoq davom etadigan jarayondir."
Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia.
The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed NetamLoader.
The attack has not been attributed to any known threat actor or group. Nor is it clear if the intrusion compromised more than one system and allowed the hackers to steal any sensitive information.
The Russian cybersecurity company said the artifact was detected in the first half of 2026, packaged inside a Windows cabinet archive (CAB) file placed in a directory that stores Windows operating system update packages.
It's suspected the operation involved a supply chain attack, in which bad actors compromised a trusted third-party vendor to gain access to downstream users who rely on its services or software.
The sample in question features a ".config" file that employs AppDomainManager injection to load arbitrary .NET assemblies. AppDomainManager injection is an adversarial technique used to load arbitrary payloads by hijacking .NET Framework's AppDomainManager mechanism when a .NET application starts.
Put differently, the approach targets .NET Framework's application-domain initialization to achieve code execution. The end result is the same as DLL sideloading: to run malicious code inside a legitimate application's process so as to fly under the radar.
According to Kaspersky, the CAB archive containing the .config file was placed in the path: "C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24," with its contents extracted and dropped into "C:\Windows\SoftwareDistribution\Download\Install\."
Infection chain: Stage 1
The exact delivery vehicle for the CAB archive remains unknown. Present in the archive are seven files, four of which are legitimate components of Patch My PC, an endpoint management software -
- fabric.config
- Microsoft.HostIntegration.Connectors.dll
- PatchMyPC-Enum.dll
- PatchMyPC-Models.dll
- PatchMyPC-ScriptRunner.exe
- PatchMyPC-ScriptRunner.exe.config
- Resources.resx
None of the files with the exception of "Resources.resx" embed malicious code. The infection chain plays out as a two-stage process as follows -
- The execution of "PatchMyPC-ScriptRunner.exe" serves as the launchpad for several payloads. It abuses AppDomainManager injection to parse "PatchMyPC-ScriptRunner.exe.config," resulting in the execution of "Microsoft.HostIntegration.Connectors.dll."
- Once loaded, "Microsoft.HostIntegration.Connectors.dll" finds "fabric.config" located in the same directory and parses its contents to load "Resources.resx."
- "Resources.resx" contains "multiple layers" of encoded, compressed, or encrypted payloads, such as XAML files, .NET assemblies, and JSON data, which are decoded and loaded by the component before it.
Infection chain: Stage 2
A brief description of these payloads is listed below -
- XAML-1, a loader for an embedded payload, XAML-2.
- XAML‑2 initializes the second stage of the attack chain by loading two compressed and Base64‑encoded XAML files: XAML-2-1 and XAML-2-2. XAML-2-1 is used to bypass Antimalware Scan Interface (AMSI).
- XAML-2-2 contains two parts, a .NET module (aka.NET 1 Loader) and a JSON data payload (aka JSON-1).
- JSON-1, the JSON payload that contains two components: JSON-1-c, which stores command-and-control (C2) server configuration, and JSON-1-p, which contains a Base64‑encoded file (.NET 2 Plugin) and a collection of compressed, encrypted XAML templates used to build XAML-3.
- XAML-2-2 loads .NET 1 Loader, which then serves as a decrypting, assembling, and loading for XAML‑3, reports the status to the C2 server, and deletes malicious files extracted from the CAB archive, along with CLR usage logs and Windows system Prefetch cache files to cover up the tracks.
- XAML-3, the XAML payload that runs within "dllhost.exe" and is designed to decode, decompress, and load .NET 2 Plugin.
- .NET 2 Plugin, a .NET assembly that loads the C2 configuration, gathers system information from Windows Registry, checks if the current host process is "dllhost.exe," waits a random jitter delay of 20-40 minutes before issuing its first request to the C2 server ("openaigpt4v[.]com"), and enters into a periodic polling loop to fetch an XAML file and execute it in an isolated AppDomain.
"If a valid response is received from C2, the loop pauses for 5-6 minutes before the next request; otherwise, it pauses for 22-28 hours, checking every 10 minutes to determine whether the allotted time has elapsed," Kaspersky explained.
Telemetry data gathered by Kaspersky has identified a single victim in Asia, with NetamLoader designed to attack a Windows 10 build customized for government-only use. Although the targeted Asian country was not disclosed, signs are that it's likely China, as Microsoft offers a bespoke version called Windows 10 China Government Edition specifically for the Chinese government and state-owned entities.
Earlier this August, Bloomberg reported that China's Ministry of State Security had ordered some government agencies to stop using the "Government Edition" in favor of Chinese-made Linux distributions as part of an effort to reduce its dependence on foreign technology.
"Beijing's instruction stemmed from data security concerns," Bloomberg said, citing "people familiar with the matter." No additional details were disclosed at the time.
"In today's geopolitical climate, a growing number of countries are building their own core software platforms, including operating systems, databases, middleware, and cloud services, with operating systems often the top priority," Kaspersky concluded.
"The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process. On the other hand, it also means that each country must protect this entire vast ecosystem on its own. Bringing the operation and maintenance of such a system to maturity is a lengthy process."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
