Kaspersky‘s Global Research and Analysis Team (GReAT) has uncovered an attack targeting a customised version of Windows 10 used exclusively by government organisations in an Asian country, built around a previously unknown malware framework the team has named NetamLoader.
Key Takeaways
- NetamLoader uses legitimate software components to load additional malicious code while concealing its own activity, including by removing entries from the system’s own update logs.
- Kaspersky’s investigation points to a likely software supply-chain attack, after researchers found a suspicious configuration file inside an archive stored in a Windows update folder.
- Once active, NetamLoader waits 20 to 40 minutes before its first contact with an attacker-controlled server, and up to 28 hours between retries if that server doesn’t respond, making it harder to catch in short monitoring windows.
Hidden inside a Windows update folder
Kaspersky’s investigation began in the first half of 2026, after researchers found a suspicious configuration file inside an archive stored in a Windows update folder. Most of the accompanying programs were legitimate, including components of the third-party patch management tool Patch My PC and a Microsoft-signed module. The attackers modified supporting files to make this genuine software load malicious instructions. Kaspersky has identified one victim through its threat monitoring network and has not linked the attack to any known threat group; it has not found evidence that Patch My PC or its distribution systems were compromised.
Built to evade and erase evidence
NetamLoader unpacks its malicious content through several layers of encoding, compression and encryption, then moves execution into a legitimate Windows process to make the connection to the original program harder to trace. It also interferes with an anti-malware scanning function and deletes files that could help investigators reconstruct the attack. Once active, it contacts an attacker-controlled server for further instructions, with a built-in delay of 20 to 40 minutes before the first connection and a wait of 22 to 28 hours before retrying if the server doesn’t respond — gaps Kaspersky says can leave short monitoring sessions with little to see.
“Technological sovereignty has become a priority for many governments, and operating systems are often where it starts. Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature,” said Sergey Lozhkin, Head of Kaspersky GReAT Research Center, APAC & META.
What Kaspersky recommends
Kaspersky is detecting the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*, with full technical details published on Securelist. It recommends organisations audit software update channels for unexpected executables, allow third-party management tools to run only from approved locations, and store logs outside endpoints so that gaps left by malware deleting local records turn into an alert rather than a dead end.
