Kaspersky identifies NetamLoader attack on customised government Windows systems

Kaspersky’s Global Research and Analysis Team, GReAT, has uncovered an attack targeting a customised Windows 10 version used exclusively by government agencies in an Asian country. Researchers identified a previously unknown malicious software framework called NetamLoader.

Dji Banner Inside Article - 728x90

Scrutiny of the software update ecosystem

The investigation began in the first half of 2026 after a suspicious configuration file was found in an archive inside a Windows update directory. According to Kaspersky, the attackers abused legitimate, signed software components in an attempt to execute additional malicious content on the target system.

The package’s location and components suggest software distribution or update processes may have been abused. However, researchers did not observe how the archive reached the system. Kaspersky specifically notes that its findings do not show that Patch My PC or its distribution systems were compromised.

The attacker has not been identified

The team could not link the attack to a known threat group. The country targeted was not disclosed. NetamLoader was reported to communicate with external servers for further instructions and to be capable of deleting some local records.

Kaspersky recommends that defenders verify the sources of update packages, correlate unusual endpoint behaviour and retain logs in central systems. The findings were also presented at Security Analyst Summit 2026 in Bali. The company’s detailed technical assessment is published on Securelist.

Source and further details: Official information. Prepared from the organisation’s press release.