Moscow, October 30, 2026: Kaspersky’s Global Research and Analysis Team (GReAT) has identified a targeted cyberattack deploying NetamLoader, a previously unknown malware framework, against a customised version of Windows 10 used exclusively by government organisations in an Asian country.
The attack, discovered in the first half of 2026, involved the use of legitimate software components to deliver the malware, raising concerns about the security of software update channels and the risk of supply chain attacks. Kaspersky detected the incident through its threat monitoring network and has so far identified one victim, with no attribution to any known threat group.
Attack used legitimate software
The attackers leveraged genuine programs, including components from the third-party patch management tool Patch My PC and a Microsoft-signed module, to load malicious instructions via modified supporting files. The malware was specifically designed for the targeted operating system and removed selected entries from the logs of the system’s update component. The archive containing the suspicious configuration file was found in a Windows update folder, suggesting a possible software supply chain compromise, although there is no evidence that Patch My PC or its distribution systems were breached.
NetamLoader evades detection
NetamLoader unpacks its payload through multiple layers of encoding, compression, and encryption, then executes within a legitimate Windows process to obscure its origin. The framework interferes with anti-malware scanning and deletes files that could assist investigators. Once active, it connects to an attacker-controlled server to receive further instructions, with a built-in delay of 20 to 40 minutes before the initial connection and a 22 to 28 hour wait before retrying if the server does not respond, making detection during short monitoring sessions difficult.
Kaspersky recommendations and detection
Kaspersky products detect the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*. The company recommends auditing software update channels, monitoring network traffic, storing logs outside endpoints, and using its Threat Intelligence Services, Next EDR Expert, Anti Targeted Attack (KATA), and SIEM solutions to defend against similar threats.
Sergey Lozhkin, Head of Kaspersky GReAT Research Center, APAC & META, said the incident highlights the need for defenders to examine how software components interact, not just their legitimacy. “Technological sovereignty has become a priority for many governments, and operating systems are often where it starts. Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature. This case shows why defenders need to look at how components interact, not only whether each program is legitimate,” Lozhkin said.
Disclaimer: This article is based on a press release provided by the concerned organisation and has been edited for style and clarity with the assistance of AI tools. BusinessFortnight does not verify, endorse, or take responsibility for the claims, figures, or statements made in the original release.
