Researchers from cybersecurity firm Kaspersky have uncovered a cyberattack targeting a customized version of Windows 10 used exclusively by government organizations in an unnamed Asian country.
The company’s Global Research and Analysis Team (GReAT) said the attackers used legitimate software components to launch NetamLoader, a previously unknown malware framework capable of receiving and running additional code while hiding its activity.
Kaspersky identified one victim through its threat monitoring network. It has not attributed the attack to any known threat group.
The malware appeared tailored to the government operating system, including the ability to remove selected entries from the logs of its update component.
The investigation began in the first half of 2026 after researchers detected a suspicious configuration file inside an archive stored in a Windows update folder.
Most programs accompanying the file were legitimate, including components of the third-party patch management tool Patch My PC and a Microsoft-signed module. The attackers modified supporting files to make the legitimate software load malicious instructions.
According to Kaspersky, the archive’s location and contents suggest a possible software supply chain attack, in which attackers exploit software delivery or update processes to reach victims.
However, researchers did not establish how the archive reached the affected system. The findings also do not indicate that Patch My PC or its distribution systems were compromised.
NetamLoader uses multiple layers of encoding, compression, and encryption to unpack its malicious content. It then transfers execution to a legitimate Windows process, making its connection to the original program harder to trace.
The malware also interferes with an anti-malware scanning function and deletes files that could help investigators reconstruct the attack.
Once active, it connects to an attacker-controlled server for further instructions and configuration changes.
The configuration examined by researchers specifies a delay of 20 to 40 minutes before the first connection. If the server does not provide a valid response, the malware waits another 22 to 28 hours before trying again. These intervals can make the activity difficult to detect during short monitoring sessions.
“Technological sovereignty has become a priority for many governments, and operating systems are often where it starts,” said Sergey Lozhkin, head of Kaspersky GReAT Research Center for Asia Pacific and Middle East, Turkey, and Africa.
“Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature. This case shows why defenders need to look at how components interact, not only whether each program is legitimate
Kaspersky recommended auditing software update channels, checking update packages’ origins, and monitoring update folders for unexpected executable and configuration files.
It also advised organizations to monitor suspicious endpoint behavior and infrequent connections to unfamiliar servers, and to store logs centrally to preserve evidence that attackers might erase from affected systems.
