In late October 2026, researchers at Kaspersky disclosed a piece of malware unlike most of the threats that make the news. It had no known victims beyond a single computer, no link to any known hacking group, and no ransom note or data theft to report. What made it remarkable was where it hid and what it hid inside: a trusted Windows update package, built from legitimate software, on a version of Windows 10 made only for government use in Asia. Kaspersky's Global Research and Analysis Team, known as GReAT, named the framework NetamLoader and published the full technical report on 29 October 2026, after presenting the findings at the Security Analyst Summit 2026 in Bali. This guide explains what NetamLoader is, how it works, who it targets, and what is still unknown.

What is NetamLoader, in plain English?

A loader is a first stage. It is not the malware that steals files or spies on a victim. It is the quiet program that gets onto a computer, hides itself, gets past the security scanner, and waits for its operator to send more code. NetamLoader is a previously undocumented .NET assembly-loading framework, which means it is built on Microsoft's .NET platform and works by loading extra pieces of code inside a running program. Kaspersky described the infection chain as highly sophisticated, and the reason is not the size of the code but the way it borrows trust at every step. Almost nothing in the delivery package was malicious. The package used legitimate components from Patch My PC, a widely used third-party patch management tool, and Microsoft-signed .NET assemblies, so the malicious code ran inside trusted programs rather than standing out as a separate suspicious file. That is what makes NetamLoader worth understanding even though only one victim has been found: it shows how a trusted update path and a legitimate application can become the cover for a multi-stage intrusion.

How was it found?

The sample came to light in the first half of 2026, when Kaspersky Security Network, the company's telemetry network, issued a malware detection alert for a configuration file that used a .NET start-up mechanism to load arbitrary code. The file was packaged inside a Windows cabinet archive, a CAB file, placed in the folder that stores Windows operating system update downloads, at C:\Windows\SoftwareDistribution\Download\. The archive was named e4537a1762fcafd2fd96bfc825bad34f9db9a24d, and it contained seven files. Six of them were legitimate Patch My PC components. Only one resource file carried the malicious code. Kaspersky has published hashes for the archive and its payload stages, and its products detect the threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*. The location is the first clue to how the attack worked. A CAB file sitting in the update-download folder looks like part of the normal patching process, and the contents were mostly genuine patching software, so there was very little for a scanner or an administrator to notice.

The infection chain, step by step

The chain starts when a legitimate program, PatchMyPC-ScriptRunner.exe, runs. Its configuration file has been manipulated so that, through a technique called AppDomainManager injection, it loads a Microsoft-signed library, Microsoft.HostIntegration.Connectors.dll, before the program's own main function starts. That library then loads the attacker's code. From there the framework unpacks itself in stages, built on XAML markup and .NET components. One stage is designed to interfere with Windows antimalware scanning, so the later stages are not inspected as they load. Another stage moves execution into dllhost.exe, a standard Windows process, separating the later activity from the original program. The final piece, called the .NET 2 Plugin, gathers system information from the Windows Registry and then contacts a command-and-control server. It waits 20 to 40 minutes before its first connection, then enters a polling loop, and if no valid response arrives it waits 22 to 28 hours before trying again. That long, patient rhythm is deliberate: it avoids the burst of network activity that would draw attention, and it lets the operator send further code only when the compromised machine checks in. The command-and-control domain Kaspersky lists is openaigpt4v.com, a name that imitates an AI model, reached at the IP address 104.18.14.219, first seen on 27 September 2023 and hosted through Cloudflare infrastructure. The framework also filters entries from the log path %WINDIR%\Logs\CmitUpdateAgent, which Kaspersky linked to the custom Windows 10 build it was designed to attack, and it works to remove its own forensic traces as it goes.

Why the target matters

NetamLoader was not built for ordinary computers. Kaspersky's telemetry identified a single victim in Asia, and the malware was designed to attack a specially customised, government-only version of Windows 10. From that design, Kaspersky inferred that the intended victims are Asian government entities. The country was not named, and the researchers were careful to present the government targeting as an inference from the custom operating system, not as a confirmed attribution. Reporting on the disclosure has noted signs pointing to the bespoke Windows 10 China Government Edition, the version Microsoft offers specifically for the Chinese government and state-owned entities, but that identification is an inference drawn by journalists, not a statement by Kaspersky, and it should be treated as such. The targeting is what makes the case significant for defenders. A custom government build is often assumed to be safer than a standard one, because it is used by fewer people and controlled more tightly. NetamLoader shows the opposite can be true: a small, specialised user base means fewer eyes on the system, and a trusted update path that is rarely questioned can become the delivery route. The practical lesson Kaspersky's report carries is narrower than the headlines: custom government builds still need the same scrutiny as mainstream systems.

What is known, and what is not

Several things are firmly established, and several are not. What is known: the framework exists, it was found in the first half of 2026, it uses legitimate Patch My PC components and a Microsoft-signed library as its launchpad, it contacts the command-and-control domain listed above, and Kaspersky found one victim through its telemetry. What is not known is at least as important. The exact delivery mechanism for the CAB archive remains unknown, although the location and contents strongly suggest a supply-chain compromise, in which a trusted third-party product was abused to reach downstream users. It is not clear whether the intrusion compromised more than one system, or whether any sensitive information was stolen. No link to a known threat group has been established: after analysing the tactics, code similarities and infrastructure, Kaspersky said it was unable to link the attack to any known APT group, and the report's title calls the actor an unknown APT. There is also no CVE number attached to NetamLoader, because the attack does not exploit a single disclosed vulnerability in the usual sense; it abuses legitimate mechanisms. And the findings do not show that Patch My PC or its distribution systems were themselves compromised. The distinction matters: the attackers appear to have repackaged genuine Patch My PC files with a malicious addition, rather than breaking into the vendor.

Should home users worry?

For ordinary home users the risk is very low. NetamLoader was built for a customised Windows 10 edition used only by government organisations in Asia, and Kaspersky found a single victim in its telemetry. Nothing in the report points at home PCs, online shoppers or gamers, and there is no sign of the framework being used in a mass campaign. The serious risk sits with government organisations running customised Windows builds, and with any organisation that treats its patching and update pipeline as inherently trustworthy. For those defenders, the report is a checklist rather than a warning to the public. The indicators to look for are the CAB archive name e4537a1762fcafd2fd96bfc825bad34f9db9a24d in the Windows update-download folder, any contact with the command-and-control domain openaigpt4v.com, the presence of Patch My PC components in unexpected places, and the Kaspersky detection names listed above. Any organisation that finds those indicators should preserve evidence before cleaning the machine, because wiping an infected system destroys the traces that show how far the intrusion went. Keeping patch management software and endpoint protection up to date, and watching the folders where update packages land, are the practical defences the case points to.

Why NetamLoader matters beyond one victim

A single victim and an unknown attacker would normally make a small story. NetamLoader matters because of the method, not the scale. It is a supply-chain style attack in which the malicious code arrives inside a package that is almost entirely genuine, runs inside a signed and trusted program, moves into a standard Windows process, waits patiently before phoning home, and cleans up after itself. Each of those steps is designed to defeat a different layer of defence: the package defeats file inspection, the signed launcher defeats trust checks, the move into dllhost.exe defeats process monitoring, the long delays defeat network anomaly detection, and the trace removal defeats forensic investigation. That is why Kaspersky called the chain highly sophisticated, and why the case has been widely reported even though the victim count is one. It is also a reminder that attribution is hard and that responsible reporting leaves gaps open. The country is unnamed, the actor is unknown, the delivery route is unproven, and whether data was stolen is unclear. What is certain is that a government-only Windows build was targeted through its own update machinery, and that the framework built to do it is now documented, named, and detectable. For defenders, that documentation is the useful part: the indicators are published, the detection names exist, and the next time a CAB file appears in an update folder with a Patch My PC wrapper and a silent phone call to an AI-sounding domain, someone will know what to look for.

Sources: Kaspersky Securelist, Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia (29 October 2026), and The Hacker News, NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection (1 November 2026).