Security researchers at Kaspersky’s Global Research and Analysis Team have uncovered a previously undocumented malware loader, dubbed NetamLoader, built specifically to infect a customized, government-restricted edition of Windows 10 used only by certain government bodies in Asia. The campaign bears the hallmarks of a supply-chain-style operation, and no known threat group has yet been publicly linked to it.

Hiding in Plain Sight Inside an Update Package

Kaspersky’s GReAT team says it first detected unusual activity in the first half of 2026, when its threat-monitoring network flagged a suspicious configuration file sitting inside a Windows update CAB archive — specifically, within the folder Windows normally uses to stage legitimate update packages. The full technical writeup was published on Kaspersky’s Securelist research blog on October 29, 2026.

What made the archive convincing was that almost everything inside it was genuine. Most of the files belonged to Patch My PC, a legitimate third-party patch management tool, and the .NET components used later in the infection chain carried valid Microsoft signatures. Only a single file, Resources.resx, actually contained the malicious payload. Researchers have not determined exactly how the booby-trapped archive reached its target, and they found no indication that Patch My PC itself was compromised at the source.

A Multi-Layered Infection Chain

The attack begins when a legitimate executable, PatchMyPC-ScriptRunner.exe, launches. Its accompanying configuration file abuses a technique known as AppDomainManager injection to run attacker-supplied code before the program’s own main function even starts. That configuration file points to a Microsoft-signed module, which in turn loads a second file called fabric.config, which forces Windows to open the tampered Resources.resx file. From there, a known weakness in the legacy .NET BinaryFormatter feature triggers execution of the first hidden script, written in XAML.

What follows is a series of nested layers, each one encoded, compressed, or encrypted, with the very first decryption key pulled directly from the command line used to launch the original program. If that command line does not match what the malware expects, as would typically happen inside a security sandbox, decryption silently fails and the chain simply stops, leaving analysts with nothing to examine.

Once past that check, a second-stage script disables Windows’ built-in Antimalware Scan Interface (AMSI) so that subsequent scans report files as clean regardless of their actual content, and splits its sensitive strings into small fragments specifically to defeat signature-based detection. The loader then methodically cleans up after itself, deleting extracted files, .NET usage logs, and Windows Prefetch entries, and even scrubbing lines from update logs inside a folder Kaspersky believes may be tied to the custom government Windows build. To make detection harder still, the final payload is launched inside dllhost.exe via a remote COM object, separating it from the original process in a way designed to slip past behavior-based endpoint defenses.

A Deliberately Slow, Patient Command Channel

The final-stage implant, which Kaspersky calls the .NET 2 Plugin, communicates with a command-and-control server at a domain designed to look like an AI product — openaigpt4v[.]com — though the domain is actually hosted behind Cloudflare’s infrastructure. The malware waits a deliberate 20 to 40 minutes before making its very first contact with that server, a delay clearly intended to outlast the runtime limits of most automated sandbox analysis tools.

Once it receives a valid response, the malware checks in every five to six minutes. If the server goes quiet, it falls back to a much longer rhythm, waiting 22 to 28 hours and then polling every ten minutes to see whether that window has elapsed, before a built-in timer eventually shuts the process down entirely after roughly 28 hours. All communications are encrypted with AES and verified with an HMAC check, and the malware probes for network proxies through three separate methods so it can continue operating even inside heavily locked-down government networks. Any downloaded XAML scripts run inside a temporary, disposable AppDomain that is torn down afterward, keeping the main process stable and minimizing forensic traces.

A Narrow, Targeted Campaign

Kaspersky says its telemetry turned up just a single confirmed victim so far. Because the malware is purpose-built to run on a government-exclusive variant of Windows 10, researchers believe the intended targets are government organizations somewhere in Asia. The firm’s report draws a broader conclusion from the case: countries that build and maintain their own customized operating system distributions carry the burden of securing the entire software supply chain themselves — a task researchers note takes considerable sustained effort.

Kaspersky’s products detect the threat family under several signatures, including HEUR:Trojan.MSIL.NetamLoader.gen and related Trojan.MSIL.Zapchast and Trojan.Script.Agent variants. Defenders are advised to:

• Watch Windows update directories for unexpected configuration files
• Flag signed applications that load code through unusual injection techniques
• Hunt for Windows processes making outbound connections they should not be making
• Pay attention to gaps or missing entries in local logs, a potential sign that logs have been deliberately scrubbed

Centralizing log collection on a separate server, researchers note, helps preserve evidence even when malware like NetamLoader actively tries to erase its own tracks locally.