Mumbai, October 28, 2026: Kaspersky’s Global Research and Analysis Team (GReAT) has identified an attack targeting a customised version of Windows 10 used solely by government organisations in an Asian country, deploying a previously unknown malware framework named NetamLoader.
The attack, discovered through Kaspersky’s threat monitoring network in the first half of 2026, involved the use of legitimate software components to deliver NetamLoader, which is capable of running additional code while concealing its activity. Kaspersky has so far identified one victim and has not attributed the incident to any known threat group.
Malware exploits legitimate software
The attackers leveraged genuine software, including components from the third-party patch management tool Patch My PC and a Microsoft-signed module, using modified supporting files to load malicious instructions. The malware was specifically built for the targeted operating system, removing selected entries from the logs of the system’s update component. Kaspersky noted that while the archive containing the malware was found in a Windows update folder, there is no evidence that Patch My PC or its distribution systems were compromised.
NetamLoader’s evasion techniques
NetamLoader unpacks its malicious content through multiple layers of encoding, compression, and encryption, then transfers execution into a legitimate Windows process, making detection more difficult. The framework also interferes with anti-malware scanning functions and deletes files that could assist investigators in reconstructing the attack. Once active, NetamLoader connects to an attacker-controlled server to receive further instructions, with configuration settings that delay the initial connection by 20 to 40 minutes and subsequent attempts by 22 to 28 hours if no valid response is received.
Potential supply chain attack
The location and contents of the archive suggest a possible software supply chain attack, where attackers exploit software delivery or update processes to reach their targets. However, researchers did not observe the initial infection vector and have not linked the attack to a compromise of Patch My PC or its distribution channels.
Kaspersky’s response and recommendations
Kaspersky products detect this threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*. The company recommends auditing software update channels, monitoring for unexpected files in update folders, verifying the origin of update packages, and using endpoint detection and response tools such as Kaspersky Next EDR Expert and Kaspersky Anti Targeted Attack (KATA) to spot stealthy behaviour and infrequent network connections. Additionally, Kaspersky advises storing logs outside endpoints with Kaspersky SIEM to preserve evidence that attackers may attempt to erase.
“Technological sovereignty has become a priority for many governments, and operating systems are often where it starts. Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature. This case shows why defenders need to look at how components interact, not only whether each program is legitimate,” said Sergey Lozhkin, Head of Kaspersky GReAT Research Center, APAC & META.
Kaspersky is a global cybersecurity and digital privacy company.
Disclaimer: This article is based on a press release provided by the concerned organisation and has been edited for style and clarity with the assistance of AI tools. BusinessFortnight does not verify, endorse, or take responsibility for the claims, figures, or statements made in the original release.
