Cybersecurity firm **Kaspersky** has detailed the discovery of **NetamLoader**, a previously unknown piece of malware exhibiting advanced capabilities and a highly specific target profile. The malware was detected on a single system in the first half of 2026, indicating a highly tailored and potentially ongoing operation. ### Targeting Custom Government Systems **NetamLoader** is designed to infect a specialized version of **Windows 10** exclusively utilized by government organizations in Asia. This specificity suggests the attackers possess intimate knowledge of their targets' technological infrastructure, enabling them to craft highly effective and evasive tools. While **Kaspersky** has not identified the specific country or agency involved, nor linked the attack to any known state-sponsored hacking group, the sophistication points towards nation-state involvement. ### Supply-Chain Attack Vector Suspected Researchers believe the operation likely involved a supply-chain attack. The malware was found within a package residing in a directory typically used for **Windows** operating system updates. This package contained legitimate software components, including files from the third-party update management tool **Patch My PC** and programs digitally signed by **Microsoft**. This method allows attackers to compromise trusted software or its distribution channels, thereby gaining access to their intended victims through seemingly legitimate means. ### Malware Capabilities and Evasion Techniques Upon activation, **NetamLoader** demonstrates a range of malicious functionalities: * **Security Interference**: It can disrupt **Windows** security scanning processes. * **Stealth**: The malware is capable of concealing its activities and deleting files and system logs to cover its tracks. * **Information Gathering**: It collects data about infected computers. * **Payload Delivery**: **NetamLoader** can download and execute additional malicious code. * **C2 Communication**: It establishes encrypted connections with attacker-controlled infrastructure for command and control. ### Implications for Customized OS Security The discovery of **NetamLoader** highlights a critical vulnerability in the security of customized government operating systems. While these bespoke systems offer countries full autonomy over their development, operation, and upgrading, they also place the entire burden of securing this vast ecosystem solely on the respective nation. **Kaspersky** noted: "The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process. On the other hand, it also means that each country must protect this entire vast ecosystem on its own." As of the report, only one infected system has been identified, and it remains unconfirmed whether sensitive information was successfully exfiltrated. The precise method of initial compromise, including whether the software update infrastructure itself was breached, is still under investigation.