Kaspersky Uncovers NetamLoader Malware Targeting Customized Government Windows Systems in Asia

BALI, Indonesia — Cybersecurity company Kaspersky has disclosed a sophisticated malware campaign targeting a customized version of Windows 10 used by government organizations in an Asian country. The research, presented at the Security Analyst Summit 2026 and published on October 29, identifies a previously unknown malware framework named NetamLoader. According to Kaspersky, the attackers combined legitimate software components with malicious configuration files to execute unauthorized code while attempting to conceal their activities from security monitoring systems.

Researchers Identify Sophisticated Malware Framework

Kaspersky’s Global Research and Analysis Team discovered the suspicious activity during an investigation that began in the first half of 2026. The initial detection involved a configuration file contained in an archive located within a Windows software update directory. Although the archive included legitimate software components, further analysis revealed a complex mechanism designed to load malicious instructions through trusted programs.

The researchers named the framework NetamLoader after examining its execution process and associated files. The malware uses multiple layers of encoding, compression, and encryption to conceal its components. This design makes the activity more difficult to identify through conventional file inspection because individual components may appear legitimate until they are combined during execution.

Attack Exploits Trusted Software Components

The infection chain involved legitimate components associated with the Patch My PC software management tool, along with Microsoft-signed modules. Kaspersky found that the attackers used modified supporting files to cause trusted software to execute malicious instructions. Importantly, the researchers did not establish that Patch My PC itself or its distribution infrastructure had been compromised.

The malware was designed to operate within a customized Windows environment used exclusively by government organizations. It could receive additional instructions from an attacker-controlled server, interfere with security scanning functions, and remove selected files that might help investigators reconstruct the attack. The framework also used delayed network communications, potentially allowing it to avoid detection during short monitoring periods.

Government Technology Infrastructure Faces Specialized Threats

Kaspersky identified one victim through its monitoring network and concluded that the malware was developed for a government-specific operating system environment in Asia. The researchers have not attributed the attack to a known advanced persistent threat group. The precise method used to deliver the malicious archive remains unconfirmed, although its location and structure suggest a possible software supply-chain attack.

The findings demonstrate how customized technology environments can face unique security challenges. Government organizations may develop specialized operating systems or software configurations to meet national security and operational requirements, but these environments still depend on update mechanisms, maintenance tools, and supporting software. Attackers may exploit weaknesses in those supporting processes rather than targeting the operating system directly.

Organizations Urged to Strengthen Software Update Security

Kaspersky recommends that organizations review software update channels, verify the origins of update packages, and monitor unusual activity involving trusted applications. Security teams should also investigate unexpected configuration changes, suspicious execution patterns, and unfamiliar network connections originating from sensitive systems. These measures can help identify attacks that attempt to disguise malicious activity within legitimate software processes.

The NetamLoader investigation highlights the importance of examining how trusted software components interact, rather than assuming that digitally signed applications are always operating safely. For government agencies and enterprises managing specialized systems, the research reinforces the need for continuous monitoring, supply-chain security assessments, and effective incident response capabilities.