Kaspersky researchers have identified an attack targeting a customised version of Windows 10 used exclusively by government organisations in an Asian country. The attackers used legitimate software components to deploy NetamLoader, a previously unknown malware framework capable of receiving and executing additional code while concealing its activity.

Kaspersky identified one victim through its threat monitoring network but has not linked the attack to a known threat group. The malware was tailored to the targeted operating system and, among other actions, removes selected entries from the system’s update component logs.

The investigation began in the first half of 2026, when researchers detected a suspicious configuration file inside an archive stored in a Windows update folder. Most of the accompanying programs were legitimate, including components of the third-party patch management tool Patch My PC and a Microsoft-signed module.

The attackers used modified supporting files to make legitimate software load malicious instructions. The archive’s location and contents suggest a possible software supply chain attack involving the abuse of software delivery or update processes.

Researchers did not establish how the archive reached the victim. They also found no evidence indicating that Patch My PC or its distribution systems had been compromised.

How NetamLoader operates

NetamLoader unpacks its malicious content through multiple layers of encoding, compression and encryption. It then transfers execution to a legitimate Windows process, making the connection to the original program harder to trace.

The framework also interferes with an anti-malware scanning function and deletes files that could help investigators reconstruct the attack.

Once active, NetamLoader contacts an attacker-controlled server to receive further instructions and configuration changes. The configuration analysed by researchers specifies a delay of 20 to 40 minutes before the first connection. If the server does not provide a valid response, the malware waits 22 to 28 hours before attempting to connect again.

These delays can limit the network activity visible during short monitoring sessions, making the malware harder to detect.

Sergey Lozhkin, head of Kaspersky’s GReAT Research Center for APAC and META, said the case highlights the need to secure the wider software ecosystem surrounding customised operating systems, including update channels and maintenance tools.

Detection and mitigation

Kaspersky products detect the threat under the following signatures:

HEUR:Trojan.MSIL.NetamLoader.gen

Trojan.MSIL.Zapchast.*

Trojan.Script.Agent.*

Researchers have published a technical report containing indicators of compromise on Securelist.

To reduce the risk of similar attacks, organisations should:

Audit software update channels: Monitor update directories for unexpected executables and configuration files, verify the origin of update packages, and restrict third-party management tools to approved locations.

Monitor suspicious endpoint activity: Investigate signed programs loading code through modified configuration files, Windows processes connecting to unfamiliar external servers, and attempts to interfere with anti-malware scanning.

Identify unusual network connections: Monitor infrequent or encrypted connections to unfamiliar external servers, including connections routed through content delivery networks. Long gaps between connection attempts should also be considered during investigations.

Centralise log collection: Store logs outside individual endpoints to preserve evidence if malware deletes local records. Monitor for unexplained gaps in system caches, .NET usage logs and update-component records.

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!