Kaspersky finds NetamLoader on one Asian government Windows system
Original title: Hackers target government Windows systems in Asia with new malware
The loader uses signed Microsoft components, can hide activity, and its delivery path is unconfirmed.
Kaspersky reported previously unknown malware it calls NetamLoader on one computer in the first half of 2026. Analysis suggested the sample targeted a specialized Windows 10 build used only by government organizations in Asia. The package sat in a Windows update directory and included legitimate components, including Patch My PC files and Microsoft-signed programs. Once run, it could interfere with security scanning, hide activity, delete files and logs, collect host information, download more code, and use encrypted communications. Kaspersky could not name a country, agency, or known state-sponsored group.
Unconfirmed: Country, agency, infection count, data theft, and whether update infrastructure was compromised remain unconfirmed.
- Only one infected system was identified.
- Researchers suspect a supply-chain attack but have not confirmed it.
- The package included Patch My PC files and Microsoft-signed programs.
- Data theft and compromise of update infrastructure were not established.
- Kaspersky could not attribute the activity to a known group.
Impact: Collects host data, downloads code, and deletes logs
| Product | Affected |
|---|---|
| Microsoft Windows 10 | customized government build in Asia |
- ATT&CK
- T1195 Supply Chain CompromiseT1218 System Binary Proxy ExecutionT1070 Indicator RemovalT1105 Ingress Tool TransferT1573 Encrypted Channel
- Vendors
- Microsoft
- Products
- Windows 10Patch My PC
- Malware
- NetamLoader
- Organizations
- Kaspersky
From the original article
2 min read at therecord.mediaThe previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.