NetamLoader disclosure exposes attack on government Windows systems in Asia

Kaspersky has disclosed a previously undocumented malware framework called NetamLoader targeting a custom Windows 10 build used exclusively by government entities in Asia. Its telemetry identified a single victim; the attacker and any theft of sensitive information remain unknown. The infection chain uses legitimate application components to load malicious code inside trusted processes. Its payloads bypass a Windows malware-scanning interface, remove files and execution traces, and contact a remote server to retrieve and execute further code. Kaspersky detected the artifact in the first half of 2026. A supply chain compromise is suspected, but the archive's delivery method remains unknown.