Kaspersky's GReAT team reported on 28 October 2026 an attack on a customised Windows 10 version used solely by government organisations in an Asian country, which Kaspersky does not name. Attackers used legitimate software components, including Patch My PC patch-management components and a Microsoft-signed module, to load a previously unknown malware framework called NetamLoader.

How the loader hides

NetamLoader can receive and run additional code while concealing its activity. It unpacks through layers of encoding, compression and encryption, then moves execution into a legitimate Windows process. It also interferes with an anti-malware scanning function, deletes files that could aid investigation, and delays its first server connection by 20 to 40 minutes, or 22 to 28 hours on retry.

Attribution withheld

Kaspersky identified one victim through its threat-monitoring network and has not attributed the attack to any known threat group. The archive was found in a Windows update folder in the first half of 2026.

Kaspersky says there is no evidence Patch My PC or its distribution systems were compromised. The supply-chain link is therefore possible, not proven, and this post does not present it as a confirmed vendor breach. The findings come from Kaspersky's Global Research and Analysis Team, whose threat-monitoring network identified the single victim.

Sources: CXO Today and Business Fortnight.