Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered an attack targeting a customized version of Windows 10 used exclusively by government organizations in an Asian country. The attackers used legitimate software components to launch NetamLoader, a previously unknown malware framework that can receive and run additional code while concealing its activity.
Kaspersky identified one victim through its threat monitoring network and has not linked the attack to any known threat group. The malware was built for this specific operating system: among other steps, it removes selected entries from the logs of the system’s own update component.
The investigation began in the first half of 2026, when Kaspersky detected a suspicious configuration file inside an archive stored in a Windows update folder. Most of the accompanying programs were legitimate, including components of the third-party patch management tool Patch My PC and Microsoft signed module. The attackers used modified supporting files to make this genuine software load malicious instructions. The location and contents of the archive point to a possible software supply chain attack, in which attackers abuse software delivery or update processes to reach their targets. Researchers did not observe how the archive reached the victim, and the findings do not indicate that Patch My PC or its distribution systems were compromised.
NetamLoader unpacks its malicious content through several layers of encoding, compression and encryption. It then moves execution into a legitimate Windows process, making the connection to the original program harder to trace. The framework also interferes with an anti-malware scanning function and deletes files that could help investigators reconstruct the attack.
Once active, NetamLoader contacts an attacker-controlled server to receive further instructions and configuration changes. The configuration researchers analyzed includes a delay of 20 to 40 minutes before the first connection. If the server provides no valid response, the malware waits 22 to 28 hours before trying again. These delays can leave short monitoring sessions with little network activity to examine.
“Technological sovereignty has become a priority for many governments, and operating systems are often where it starts. Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature. This case shows why defenders need to look at how components interact, not only whether each program is legitimate,” Sergey Lozhkin, Head of Kaspersky GReAT Research Center, APAC& META.
Kaspersky products detect this threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*. The full technical report, including indicators of compromise, is available on Securelist.
To protect against similar threats, Kaspersky recommends:
· Utilize Kaspersky Threat Intelligence Services for access to up-to-date threat feeds, behavior-based IoCs, and detailed threat hunting reports. Compiled and powered by the expertise of Kaspersky research teams, including GReAT, it empowers analysts to leverage data from recent investigations, including this one, and examine unfamiliar samples before they reach production environments.
· Audit software update channels, because the attackers placed their package in the folder Windows uses for downloaded updates. Monitor these folders for unexpected executables and configuration files, verify the origin of every update package and allow third-party management tools to run only from approved locations.
· Detect stealthy behavior on endpoints with Kaspersky Next EDR Expert. It correlates suspicious activity such as a signed program loading code through a modified configuration file, a Windows system process connecting to external servers and tampering with anti-malware scanning, which individually might pass for routine system activity.
· Monitor network traffic with Kaspersky Anti Targeted Attack (KATA). The platform spots infrequent, encrypted connections to unfamiliar external servers, including those hidden behind content delivery networks, and helps teams track malware that waits hours or even days between check-ins.
· Store logs outside endpoints with Kaspersky SIEM, because NetamLoader deleted system cache files, .NET usage logs and entries from the update component’s records. Centralized collection preserves the evidence attackers try to erase and turns unexplained gaps in local logs into an alert.
