New NetamLoader Malware Targets Custom Government Windows Systems in Asia

Suspected nation-state hackers have developed a new malware family called NetamLoader, according to a Kaspersky report published on Thursday. The malware appears designed for a specialised version of Windows 10 used only by government organisations in Asia. Kaspersky detected it on one computer in the first half of 2026. It did not name the country or agency involved, and it is unclear how many systems were affected. The company could not link the attack to any known state-sponsored group.

The malware was found inside a package stored in a directory used for Windows operating system updates. The package contained legitimate components, including files from the update management tool Patch My PC and programs digitally signed by Microsoft. Researchers suspect a supply-chain attack, where attackers compromise trusted software or its distribution process. NetamLoader uses these legitimate components to run malicious code and evade security tools. It can interfere with Windows security scanning, hide its activity, delete files and system logs, collect information about infected computers, and download further malicious code. It also communicates with attacker-controlled infrastructure over encrypted connections.

Researchers said the malware's ability to recognise and manipulate parts of a government-specific system suggests the attackers knew their target's technology well. Kaspersky noted that countries running their own operating systems gain autonomy, but must also protect that entire ecosystem themselves. This is a summary of the opening of the report, not the full story.