New NetamLoader Malware Found Hiding in Windows Update Folders on Asian Government Systems

Kaspersky researchers have described a "highly sophisticated infection chain" aimed at government organisations in Asia. The activity involved a previously undocumented .NET assembly-loading framework named NetamLoader. It targeted a custom Windows 10 build used only by government entities in the region. Kaspersky detected the artifact in the first half of 2026. The attack has not been linked to any known threat actor, and it is unclear whether more than one system was compromised or whether any sensitive data was stolen.

The malware arrived in a Windows cabinet (CAB) archive placed in a folder that stores Windows update packages. The archive held seven files, four of which were legitimate components of Patch My PC, an endpoint management tool. Only one file, Resources.resx, was reported to contain malicious code. A configuration file used a technique called AppDomainManager injection, which abuses the way .NET Framework applications start so that malicious code runs inside a trusted application. The result is similar to DLL sideloading, helping the malware avoid detection. How the archive was delivered is still unknown, though researchers suspect a supply chain attack through a trusted third-party vendor.

Kaspersky also noted that the malware contacts its command-and-control server on a timer. After a valid response it pauses for 5 to 6 minutes, otherwise it waits 22 to 28 hours before trying again.