Attackers abused legitimate software components to deploy previously unknown malware, manipulate system logs and evade detection on a customized Windows 10 platform.
Kaspersky researchers have uncovered an attack targeting a customized version of Windows 10 used exclusively by government organizations in an Asian country, in which attackers abused legitimate software components to deploy a previously unknown malware framework.
The malware, dubbed NetamLoader, can contact an attacker-controlled server to receive additional code and configuration changes. It also uses multiple layers of encoding and encryption to conceal its payload, moves execution into a legitimate Windows process and interferes with security and forensic mechanisms, Kaspersky’s Global Research and Analysis Team (GReAT) said in a report dated October 28.
Kaspersky identified one victim through its threat monitoring network but has not attributed the activity to a known threat group. Researchers said the malware was tailored to the government-specific operating system, including by removing selected entries from the system’s update-component logs.
The investigation highlights how attackers can exploit trusted software and update processes to compromise specialized government environments, even when the components involved are legitimate.
Modified files conceal malicious activity
Kaspersky said the investigation began in the first half of 2026, when researchers found a suspicious configuration file inside an archive stored in a Windows update folder.
Most of the programs in the archive were legitimate, including components of the third-party patch management tool Patch My PC and a Microsoft-signed module. Attackers had modified supporting files so that the genuine software would load malicious instructions.
The archive’s location and contents suggested a possible software supply chain attack, in which adversaries exploit software delivery or update processes to reach their targets. However, researchers did not observe how the archive reached the victim.
Kaspersky also said its findings did not indicate that Patch My PC or its distribution systems had been compromised.
The distinction is important because abusing a legitimate program’s loading behavior does not necessarily mean the software vendor’s infrastructure has been breached. Attackers can instead manipulate files accompanying a legitimate application to make it execute malicious content.
NetamLoader unpacks its payload through several layers of encoding, compression and encryption before moving execution into a legitimate Windows process. This makes it harder for investigators to trace the activity back to the program that initially launched the malware.
The framework also interferes with an anti-malware scanning function and deletes files that could help investigators reconstruct the attack, according to Kaspersky.
Delayed connections complicate detection
Once active, NetamLoader contacts an attacker-controlled server to obtain further instructions and configuration changes.
The configuration analyzed by researchers specifies a delay of 20 to 40 minutes before the malware’s first connection. If the server does not provide a valid response, the malware waits between 22 and 28 hours before trying again.
These intervals can make the activity difficult to detect during short monitoring sessions. An endpoint may appear relatively quiet even though the malware remains active and capable of receiving further instructions.
The malware’s interference with local records compounds the problem. By deleting selected update-component log entries and other files, NetamLoader can reduce the evidence available to investigators examining a compromised machine.
For security teams, the combination of legitimate software, modified configuration files, infrequent outbound connections and log tampering illustrates why individual events may appear benign when examined in isolation.
Government-specific systems face supply chain risks
The targeted operating system is a customized version of Windows 10 used exclusively by government organizations in an Asian country. Kaspersky said NetamLoader was built specifically for that environment.
The findings also raise questions about the security implications of specialized operating systems and their surrounding maintenance ecosystems. Customization can give organizations greater control over their technology, but it also creates dependencies on update mechanisms, third-party tools and other components that must be secured.
“Technological sovereignty has become a priority for many governments, and operating systems are often where it starts,” said Sergey Lozhkin, head of Kaspersky GReAT Research Center for APAC and META.
“Running your own platform gives you control, but it also means securing the entire ecosystem around it, from update channels to the maintenance tools it relies on, and that ecosystem takes time to mature,” Lozhkin said.
He added that defenders need to examine how components interact rather than relying solely on whether each individual program is legitimate.
Kaspersky did not identify the victim organization or disclose enough information to establish the attackers’ identity, objectives or route into the environment.
What security teams should watch
Kaspersky recommends auditing software update channels, monitoring update folders for unexpected executables and configuration files, verifying the origin of update packages and restricting third-party management tools to approved locations.
It also recommends correlating endpoint activity that might otherwise appear routine, including signed programs loading code through modified configuration files, system processes making unusual external connections and attempts to interfere with anti-malware scanning.
Network monitoring is another consideration, particularly for infrequent encrypted connections to unfamiliar servers. Kaspersky said centralized logging can help preserve evidence when malware deletes local records, allowing security teams to detect unexplained gaps in endpoint logs.
Kaspersky products detect the activity under the names HEUR.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*. The company said its full technical report, including indicators of compromise, is available on Securelist.
The investigation does not establish that a software vendor’s distribution infrastructure was compromised or that the attack affected other government systems. But it demonstrates the challenges of defending specialized environments when attackers can make malicious activity appear to originate from trusted software.
For security teams, the immediate lesson is to validate not only the software they install but also the files, configurations and execution behavior surrounding it.
