Nation‑State Malware ‘NetamLoader’ Targets Customized Government Windows Systems in Asia via Suspected Supply‑Chain Attack
What Happened — Kaspersky’s research team identified a previously unknown malware family named NetamLoader that is designed to compromise a customized build of Windows 10 used exclusively by government agencies in Asia. The payload is delivered inside a package stored in the directory used for Windows OS updates and contains legitimate Microsoft‑signed components as well as files from the third‑party update tool Patch My PC. By leveraging these trusted binaries, NetamLoader can bypass security scanners, hide its activity, delete logs, and establish encrypted communications to download additional malicious code. The researchers detected the malware on a single workstation in early 2026; they have not confirmed the extent of infection, data theft, or the exact supply‑chain vector, but they suspect a compromised software‑update distribution process.
Why It Matters for Trust & Control Assurance — The incident highlights the critical need for rigorous supply‑chain risk controls and continuous verification of third‑party software updates.
Who Is Affected — Government agencies in Asia that deploy a bespoke Windows operating system; any organization that relies on third‑party update mechanisms for critical infrastructure.
Recommended Actions
- Audit your software‑update pipeline for integrity checks, cryptographic signing verification, and tamper‑evidence.
- Deploy continuous monitoring of third‑party components and maintain immutable logs as audit evidence.
- Align your supply‑chain risk program with the Identify and Protect functions of NIST CSF 2.0.
Technical Notes
- Attack vector: compromised update package (third‑party dependency).
- Malware capabilities: evades security scanning, deletes system logs, collects host information, downloads additional payloads, uses encrypted C2 channels.
- Tools referenced: Microsoft‑signed binaries, Patch My PC updater.
Source: The Record – Hackers target government Windows systems in Asia with new malware