New NetamLoader Malware Hides in Update Tools
Kaspersky's research-stage analysis shows a previously unknown framework targeting government Windows 10 systems in Asia, with no threat group attribution yet.
Updated on Nov. 5, 2026 in Cybersecurity
Kaspersky's GReAT team reported an attack on a customized Windows 10 used exclusively by government organizations in an Asian country, delivered through a previously unknown malware framework called NetamLoader. The findings are a research-stage analysis of a single identified victim, not a shipped product or a confirmed large-scale campaign.
Why it matters
NetamLoader disguises itself with legitimate software components and interferes with an anti-malware scanning function, showing how attackers are blending into trusted update tooling rather than relying on obvious malicious binaries. Because Kaspersky has not linked the attack to any known threat group, the activity is being tracked as a new actor rather than an extension of a documented campaign.
The analysis rests on detection of a single victim through Kaspersky's threat monitoring network, with timing behavior of 20 to 40 minutes before first server contact and a 22 to 28 hour retry window. The delivery vector and the actor behind the activity remain unidentified.
The players
Kaspersky GReAT
The Global Research and Analysis Team of Kaspersky, a cybersecurity firm known for threat intelligence and malware reverse engineering.
The details
NetamLoader unpacks its payload through several layers of encoding, compression and encryption, so the malicious content is hidden until late in execution. It then moves execution into a legitimate Windows process and removes selected entries from the logs of the system's update component, reducing the forensic trail left behind.
Timeline
Kaspersky detected a suspicious configuration file inside an archive in a Windows update folder during the first half of 2026.
Kaspersky publicly reported the attack and its findings on November 5, 2026.
The Tech Race
The campaign's reliance on Patch My PC and a Microsoft-signed module places it within a broader pattern of attackers hiding inside trusted update software. Kaspersky's identification of an unattributed actor adds a new entry to the threat landscape without yet tying it to any known group.
The attack is confined to a single identified government victim and does not indicate that consumer Windows 10 installations are affected. Organizations that rely on third-party patch management tools may want to review update folder contents and logs, since the malware targets exactly those locations.
The takeaway
Watch whether Kaspersky or other researchers attribute NetamLoader to a known threat group in follow-up reporting. Checking update folders and update-component logs for unexpected archives is a practical step while attribution remains open.
Further reading
Follow the latest developments in Cybersecurity to see how state-linked and unattributed threats are tracked across the region.
Source note: This article includes information reported by Upgrade Magazine.
