New 'NetamLoader' malware targets a government-only Windows build in Asia

Russian cybersecurity firm Kaspersky says it has discovered a previously unknown piece of malware, dubbed NetamLoader, that targeted a customized version of Windows 10 used exclusively by government organizations in Asia. According to The Record, Kaspersky detected the malware on one computer in the first half of 2026 and published its findings on Thursday, October 30, 2026.

What happened

The Record, citing Kaspersky, reports that NetamLoader was found inside a package stored in a directory used for Windows updates. The package included files from the third-party update tool Patch My PC alongside programs signed by Microsoft. Researchers suspect a supply-chain attack but could not confirm how the malware reached the computer, or whether the update infrastructure itself was compromised. Kaspersky did not name the country or the specific agency affected, and the number of impacted systems is unclear.

Technical details

According to the report, NetamLoader uses legitimate Microsoft software components to run malicious code, evade security tools and download additional programs — a living-off-the-land approach that helps it blend in. Once active, Kaspersky says, it can interfere with Windows security scanning, hide its activity, delete files and system logs, collect system information, download further malicious code, and communicate with attacker infrastructure over encrypted connections. Notably, The Record says the malware was able to recognize government-specific Windows components, suggesting the attackers had detailed knowledge of the target's technology.

Who is affected

The known impact is limited: Kaspersky identified only one infected system, and it is not known whether any sensitive data was stolen, per The Record. The attackers are suspected to be nation-state actors, but Kaspersky could not link the activity to any known state-sponsored group. The incident's significance lies less in its scale than in its target — a bespoke operating system built for government use, which the attackers appeared to understand in depth.

Why it matters

The Record reports that the case raises broader concerns about customized government operating systems. Kaspersky noted that while a country controls its own systems, it also "must protect this entire vast ecosystem on its own" — without the shared defenses, telemetry and patch pipelines that commercial platforms benefit from. For government IT teams running custom builds, the episode is a reminder to tightly control update directories and third-party update tooling, verify the integrity of packages placed in update paths, and monitor for abuse of signed Microsoft binaries that living-off-the-land malware like NetamLoader relies on.