Cybersecurity researchers at Kaspersky have exposed a previously unknown malware framework that hid in one of the least likely places: a custom version of Windows 10 built exclusively for government organisations in Asia. The framework, dubbed NetamLoader, was designed to receive and run additional malicious code while concealing its activity, and it did so by borrowing the camouflage of legitimate software.
The findings, published by Kaspersky's Global Research and Analysis Team and detailed on November 1, have not been linked to any known hacking group. Kaspersky identified a single victim through its telemetry; whether others were hit or data was stolen is unclear.
Hiding inside trusted software
The investigation began in the first half of 2026, when researchers spotted a suspicious configuration file inside a cabinet archive stored in the folder where Windows keeps downloaded update packages. The archive contained seven files. Six of them were legitimate: components of Patch My PC, a third-party patch management tool, along with a Microsoft-signed module. Only one file, named Resources.resx, carried malicious code.
That ratio is the point. Kaspersky found no evidence that Patch My PC itself, or its distribution systems, had been compromised, and researchers could not establish how the archive reached the victim. Its location and contents point to a possible supply-chain attack, in which attackers abuse software delivery or update processes to reach their targets.
The target itself narrows the picture further. NetamLoader was built for a specific operating system: a customised Windows 10 build used only by government entities in Asia. Among other steps, the malware removes selected entries from the logs of the system's own update component, erasing traces of its arrival. Kaspersky did not name the country, though reports note Microsoft offers a bespoke Windows 10 China Government Edition.
A patient, hard-to-trace infection chain
The infection chain is a study in patience and misdirection. It starts when PatchMyPC-ScriptRunner.exe runs. Its configuration file uses a technique called AppDomainManager injection, which loads code before the program's main function starts. That step loads a Microsoft-signed module, which reads a second file, fabric.config, and then loads the malicious Resources.resx file. A flaw in the older BinaryFormatter feature then executes the first hidden script.
From there, the malware unpacks its content through multiple layers of encoding, compression and encryption, then moves execution into a legitimate Windows process, hiding its origin. It bypasses AMSI, Windows' scanning interface for scripts, and runs inside dllhost.exe. Once active, it deletes the extracted files and clears usage logs and Prefetch files.
The malware then waits. A configuration analysed by researchers sets a delay of 20 to 40 minutes before the first connection to an attacker-controlled server, where it can receive further instructions. If the server gives no valid response, NetamLoader waits 22 to 28 hours before trying again.
What defenders should watch for
Sergey Lozhkin, head of Kaspersky's GReAT research centre for the Asia-Pacific and Middle East regions, said the case highlights the need to secure the wider software ecosystem surrounding customised operating systems, including update channels and maintenance tools. A locked-down system, he argued in effect, can still be exposed through the trusted tools that service it.
Kaspersky products detect the threat under the signatures HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast and Trojan.Script.Agent, and the company has published a full technical report with indicators of compromise. For defenders, the lessons are straightforward: verify patch-management components against known-good versions rather than trusting file names, monitor Windows update folders for unexpected archives, and treat unusual activity from legitimate processes such as dllhost.exe as worth investigating. NetamLoader shows the most dangerous malware may arrive wearing a trusted uniform.
