NetamLoader malware infects custom Windows 10 used by Asian governments
Kaspersky detected the NetamLoader malware on a computer running a custom Windows 10 build used exclusively by Asian government organizations in the first half of 2026. The malware sat in a Windows update directory mixed with legitimate Patch My PC files and Microsoft-signed .NET assemblies, raising suspicion of a supply-chain attack. Only one infected system was identified, there is no attribution to a known group and no confirmed data theft, and the sources mention no fix.
What happened
Kaspersky detected the NetamLoader malware on a computer running a custom Windows 10 build used exclusively by Asian government organizations in the first half of 2026. The malware was hidden in a Windows update folder mixed with legitimate files, suggesting a supply-chain attack. Only one infected system was identified.
Why it matters
According to Kaspersky, the malware interferes with Windows security scanning, conceals its activity, deletes files and system logs, collects machine information, downloads additional code and communicates with attacker infrastructure over encrypted connections. No data theft has been confirmed, but the ability to download extra programs keeps government operations and data exposed to any future payload. Kaspersky assessed that manipulating a government-specific system indicates detailed knowledge of the target.
What to do
Treat machines running this custom Windows 10 build as possibly compromised: check Windows Update and Patch My PC directories for suspicious packages and monitor dllhost.exe for anomalous behavior. Investigate unknown encrypted outbound connections and preserve logs, since the malware can delete them.
For the technical team
- Affected
- Build customizado do Windows 10 distribuído a governos asiáticos (malware NetamLoader escondido em pasta do Windows Upda · Custom Windows 10 build used exclusively by government organizations in Asia. Country and agency not identified by Kaspersky; only one infected system confirmed.
- Exploitation
- Malware detected on one real system by Kaspersky in the first half of 2026. The Record reports suspected nation-state hackers, but Kaspersky could not link the attack to any known APT group. No public PoC mentioned and no data theft confirmed.
- Fix
- Not mentioned in the sources.
- Vector
- Suspected supply-chain attack: a malicious package stored in a directory used for Windows Updates, mixed with legitimate Patch My PC components and Microsoft-signed .NET assemblies, with XAML payloads to bypass security scanning. The infection chain uses .NET injection with a previously undocumented assembly-loading framework, hides inside dllhost.exe and downloads additional code. Kaspersky could not confirm how the malware reached the machine or whether the update infrastructure was compromised.
- More details
- The malware interferes with Windows security scanning, conceals its activity, deletes files and system logs, collects information about the infected computer and communicates with attacker-controlled infrastructure through encrypted connections. Kaspersky said the malware's ability to recognize and manipulate components of a government-specific Windows system suggests detailed knowledge of the target's technology, and highlighted the risk of custom operating systems, where each country must protect the entire ecosystem on its own.
Timeline
Kaspersky details the infection chain: .NET injection using a previously undocumented assembly-loading framework.
Kaspersky details the NetamLoader infection chain: legitimate Patch My PC components, Microsoft-signed assemblies and XAML payloads to bypass security scanning, with the malware hiding inside dllhost.exe and downloading additional code.
New details on how NetamLoader works: the malware uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers.
Want the next updates in your inbox? Get the daily edition →
See all 4 updates
Kaspersky attributes the poisoned Windows 10 build delivering NetamLoader to an unknown APT group.
Sources 4 sources
- @IntCyberDigest @IntCyberDigest
- Hackers target government Windows systems in Asia with new malware The Record
- @DarkWebInformer @DarkWebInformer
- NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection The Hacker News
