Skip to content
Unknown APT Targets Government Windows 10 Systems with NetamLoader

Unknown APT Targets Government Windows 10 Systems with NetamLoader

First seen 29 Oct 2026, 14:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 15:14 UTC
  • •NetamLoader targets a custom Windows 10 OS used by government entities in Asia.
  • •The malware utilizes legitimate software components to conceal its activities.
  • •Kaspersky has not attributed the attack to any known APT group.

Kaspersky's GReAT has identified a sophisticated attack using NetamLoader, a new malware framework targeting a customized version of Windows 10 used by government organizations in Asia. The attack leverages legitimate software components, including the Patch My PC tool, to conceal malicious activities. Initial detection occurred in the first half of 2026 when a suspicious configuration file was found in a Windows update folder. The malware is designed to remove logs from the system's update component and can execute additional code while evading detection. Kaspersky has not linked this attack to any known threat group and has identified at least one victim through its monitoring network. The malware's detection is classified under HEUR:Trojan.MSIL.NetamLoader.gen and similar variants. The investigation highlights the risks associated with supply chain attacks, particularly in government environments. Kaspersky recommends vigilance in monitoring software interactions and update processes.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-01
Initial detection of suspicious file
Kaspersky identified a suspicious configuration file in a Windows update folder, indicating a potential supply chain attack.
Securelist
2026-10-29
Public disclosure of NetamLoader
Kaspersky's GReAT published findings on the NetamLoader malware framework targeting government systems.
Itvoice.In

More articles in this cluster (7)

Following this threat?

Track NetamLoader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (29)

1 / 4

Common questions

What systems are affected?
The attack specifically targets a customized version of Windows 10 used by government organizations in Asia.
Is there any attribution for the attack?
No, Kaspersky has not linked the attack to any known threat group.
What should organizations do to protect themselves?
Organizations should monitor software interactions and update processes closely to mitigate risks from supply chain attacks.