Attackers used trusted programs to run harmful software on a special version of Windows 10 used only by government organizations in an Asian country, according to Kaspersky’s Global Research and Analysis Team (GReAT).
Called NetamLoader, the harmful software, or malware, can receive and carry out more instructions from attackers while hiding what it does. Kaspersky found one victim and said the malware was designed for this particular version of Windows. Researchers have not linked the attack to any known hacking group.
“Technological sovereignty has become a priority for many governments, and operating systems are often where it starts,” said Sergey Lozhkin, head of Kaspersky GReAT Research Center, APAC & META. “Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature.”
Lozhkin also noted that thes case shows why defenders need to look at how components interact, not only whether each program is legitimate.
Researchers began investigating in the first half of 2026 after finding a suspicious settings file in a package stored in a Windows update folder. Most programs in the package were genuine. These included parts of Patch My PC, a tool for managing software updates, and a software component digitally signed by Microsoft.
The attackers changed files that these programs relied on, causing them to run harmful instructions. The package’s contents and location suggest attackers may have misused a software delivery or update process to reach the victim.
However, researchers could not determine how the package arrived on the computer. Kaspersky said its findings do not show that Patch My PC or the systems used to distribute its software were hacked.
NetamLoader uses several layers of protection to hide its harmful code. It then runs that code through a normal Windows process, making its activity harder to trace. It also interferes with a tool that scans for malware and deletes files and updates records that could help investigators understand what happened.
The malware waits 20 to 40 minutes before contacting the attackers’ server for instructions. If it gets no valid response, it waits another 22 to 28 hours before trying again. These long gaps can make it harder to spot during brief security checks.
Kaspersky recommends checking software updates for unexpected files and watching for unusual internet connections. Saving activity records separately from computers can help preserve evidence if attackers erase local copies.