Hackers target government Windows systems in Asia with new malware

Suspected nation-state hackers have developed sophisticated malware designed to target a customized version of Windows used by government agencies in Asia, according to new research.

The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers, Russian cybersecurity firm Kaspersky said in a report Thursday.

Researchers suspect the operation involved a supply-chain attack, in which hackers compromise trusted software or its distribution process to gain access to their intended targets.

Kaspersky detected the malware on one computer in the first half of 2026. Its analysis suggested the attack was tailored to a specialized version of Windows 10 used exclusively by government organizations in Asia.

Kaspersky did not identify the country or government agency involved, and it remains unclear how many systems may have been affected. The company said it could not link the attack to any known state-sponsored hacking group.

The malware was discovered inside a package stored in a directory used for Windows operating system updates. The package contained legitimate software components, including files belonging to the third-party update management tool Patch My PC and programs digitally signed by Microsoft.

Once activated, NetamLoader could interfere with Windows security scanning, conceal its activity and delete files and system logs. The malware was also capable of collecting information about infected computers, downloading additional malicious code and communicating with attacker-controlled infrastructure through encrypted connections.

Researchers said the malware’s ability to recognize and manipulate components of a government-specific Windows system suggested that the attackers had detailed knowledge of their intended target’s technology.

The attack also raised concerns about the security of customized government operating systems, researchers said.

“The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process. On the other hand, it also means that each country must protect this entire vast ecosystem on its own,” Kaspersky said.

Researchers had identified only one infected system and had not established whether the attackers had successfully stolen sensitive information. They also could not confirm how the malware reached the computer or whether the software update infrastructure itself had been compromised.