Skip to content
New Malware NetamLoader Targets Government Windows Systems in Asia

New Malware NetamLoader Targets Government Windows Systems in Asia

First seen 29 Oct 2026, 14:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 13:47 UTC
  • •NetamLoader targets a specialized Windows 10 version for government use in Asia.
  • •The malware utilizes legitimate software components to conceal its malicious activities.
  • •Kaspersky has identified one infected system but has not linked the attack to any known APT group.

Kaspersky's Global Research and Analysis Team (GReAT) has identified a sophisticated malware called NetamLoader, targeting a customized version of Windows 10 used by government entities in Asia. The malware employs legitimate software components to execute malicious code, evade detection, and download additional payloads. The attack is suspected to be a supply-chain compromise, leveraging trusted software delivery processes. Kaspersky detected the malware on a single system in the first half of 2026, but it remains unclear how many systems may be affected or how the malware was delivered. The malware's capabilities include logging interference and data collection, indicating a high level of sophistication. Kaspersky has not linked the attack to any known threat group, and the specific country or agency targeted has not been disclosed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5d ago How this analysis works

Timeline

2026-10-29
Kaspersky reports on NetamLoader
Kaspersky reveals details of the NetamLoader malware targeting government Windows systems in Asia.
Kaspersky
2026-10-30
The Record publishes findings
The Record reports on Kaspersky's findings regarding the NetamLoader malware and its implications for government cybersecurity.
Therecord.Media

More articles in this cluster (18)

Following this threat?

Track NetamLoader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (21)

1 / 3

Common questions

What systems are affected?
The malware targets a customized version of Windows 10 used by government organizations in Asia.
Is there evidence of active exploitation?
Currently, Kaspersky has identified only one infected system, and there is no confirmed active exploitation reported.
What should organizations do to protect themselves?
Organizations should enhance monitoring of their systems and review their software supply chain processes to mitigate potential risks.