Suspected nation-state hackers developed sophisticated malware to target a customized version of Windows used exclusively by government agencies in Asia, according to a report by Russian cybersecurity firm Kaspersky published Thursday. The previously unknown malware, designated NetamLoader, employs legitimate Microsoft software components to execute malicious code, evade security tools, and download additional programs onto infected computers.
NetamLoader malware uses supply-chain attack vectors
Researchers detected the NetamLoader malware on a single computer during the first half of 2026. Analysis suggests the attack relied on a supply-chain vector, where hackers compromised trusted software or its distribution process to reach their targets. The malware was discovered inside a package stored within a directory dedicated to Windows operating system updates. This package housed legitimate components, including files tied to the third-party update management tool Patch My PC alongside programs digitally signed by Microsoft.
Kaspersky did not identify the specific country or government agency targeted, and researchers could not confirm the total number of affected systems. It remains unclear how the malware reached the initial computer or whether the underlying software update infrastructure was directly compromised.
‼️ An unknown APT group likely poisoned the supply chain of a custom Windows 10 build for Asian governments, Kaspersky says.Its NetamLoader malware hid in a Windows Update folder among real Patch My PC files and ran via Microsoft-signed .NET code. pic.twitter.com/YwraU5xJPE
Did you know? NetamLoader can actively interfere with Windows security scans, conceal its ongoing operations, and delete critical system files and logs once activated on a compromised machine.
Technical Capabilities of the Government-Targeted Malware
Once active, NetamLoader collects detailed information about infected machines, downloads supplementary malicious payloads, and communicates with attacker-controlled infrastructure via encrypted connections. Researchers noted that the malware’s ability to recognize and manipulate components of a government-specific Windows environment indicates the attackers possessed detailed prior knowledge of the target’s internal technology ecosystem.
This operation highlights distinct vulnerabilities inherent in specialized government platforms. Kaspersky observed that while custom operating systems grant individual nations full autonomy over development and upgrading, they also force each country to independently defend a vast, closed ecosystem.
What operating systems does NetamLoader target?
What operating systems does NetamLoader target?
The malware targets a specialized, customized version of Windows 10 used exclusively by government organizations in Asia, according to Kaspersky’s findings from the first half of 2026.
Has the attack been linked to a specific state-sponsored group?
No. Kaspersky reported that researchers could not link the NetamLoader operation to any known state-sponsored hacking collective at the time of publication.
What data has been compromised in the incident?
Researchers identified only a single infected system and stated they had not yet established whether the attackers successfully extracted sensitive information from the network.
Signed Microsoft components bypass traditional monitoring tools
Investigators continue to examine how the malicious update package integrated into system directories without immediate detection. Because the files involved utilized digitally signed Microsoft components and third-party update utilities, traditional monitoring tools struggled to flag the initial payload. Researchers have not confirmed whether attackers infiltrated the software update infrastructure itself or delivered the package through an alternate vector.
Related reading