Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered a cyberattack targeting a customized version of Windows 10 used exclusively by government organizations in an Asian country. The attack involved legitimate software components to deploy NetamLoader, a previously unknown malicious framework capable of receiving and executing additional code while concealing its activities.

Kaspersky identified one victim through its threat monitoring network but has not attributed the attack to any known threat group. The malware was specifically developed to target this customized operating system, performing several actions to hide its presence, including deleting selected entries from the system’s own update component logs.

Attackers Exploit Legitimate Software Components

The investigation began in the first half of 2026, when Kaspersky detected a suspicious configuration file inside an archive stored in a Windows update folder.

Most of the accompanying programs were legitimate, including components of the third-party patch management tool Patch My PC and a Microsoft-signed module. However, attackers used modified supporting files to force the legitimate software to load malicious instructions.

According to Kaspersky, the archive’s location and contents suggest a possible software supply chain attack, in which attackers exploit software delivery or update processes to gain access to targeted systems.

Researchers could not determine how the archive reached the victim’s device. However, the investigation found no evidence that Patch My PC or its distribution systems had been compromised.

NetamLoader Uses Advanced Techniques to Conceal Malicious Activity

The NetamLoader framework extracts its malicious content through multiple layers of encoding, compression and encryption. It then transfers execution to a legitimate Windows process, making it more difficult to trace the malware back to its original program.

The framework also interferes with an anti-malware scanning function and deletes files that could help investigators reconstruct the attack.

Once activated, NetamLoader connects to an attacker-controlled server to receive additional instructions and configuration updates. The configuration analyzed by researchers included an initial delay of 20 to 40 minutes before the first connection.

If the malware receives no valid response from the server, it waits between 22 and 28 hours before attempting to reconnect. These deliberate delays reduce network activity during short monitoring periods, making the threat harder to detect and analyze.

Kaspersky: Securing Government Operating Systems Requires Protecting the Entire Ecosystem

Sergey Lozhkin, Head of Kaspersky GReAT Research Center for APAC and META, said that technological sovereignty has become a priority for many governments, with operating systems often serving as the starting point.

He explained that operating an independent platform provides greater control but also requires securing the entire supporting ecosystem, from software update channels to maintenance tools.

Lozhkin emphasized that building a mature and secure ecosystem takes time, adding that the incident highlights the importance of examining how different system components interact rather than checking whether each individual program is legitimate.

Kaspersky products detect the threat under the following names: HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*.

The company has made the full technical report, including indicators of compromise, available on Securelist. Kaspersky’s GReAT team also presented its findings at the Security Analyst Summit 2026 in Bali.

Kaspersky Recommends Measures to Protect Against Similar Cyberattacks

To help organizations defend against similar threats, Kaspersky recommends using Kaspersky Threat Intelligence Services to access updated threat feeds, behavior-based indicators of compromise (IoCs) and detailed threat hunting reports. These resources enable security analysts to examine unfamiliar samples and benefit from insights gathered through recent investigations.

The company also advises organizations to audit software update channels, monitor update folders for unexpected executable and configuration files, verify the origin of update packages and restrict third-party management tools to approved locations.

Additional recommendations include deploying Kaspersky Next EDR Expert to detect stealthy endpoint behavior by correlating suspicious activities, such as signed programs loading code through modified configuration files, Windows processes connecting to external servers and interference with anti-malware scanning.

Kaspersky also recommends monitoring network traffic through Kaspersky Anti Targeted Attack (KATA), which can identify infrequent encrypted connections to unfamiliar external servers, including those concealed behind content delivery networks.

Finally, the company highlights the importance of storing logs outside endpoint devices using Kaspersky SIEM. Centralized log collection helps preserve digital evidence that malware may attempt to erase, including system cache files, .NET usage logs and records from Windows update components.