New NetamLoader malware hits restricted government Windows 10 build in Asia
Researchers have found NetamLoader targeting a government-only Windows 10 build in Asia, abusing Patch My PC components, hijacking .NET execution and bypassing AMSI, with at least one victim identified so far.
Security researchers have uncovered a new piece of malware aimed at a highly restricted operating system used by an unnamed Asian government, raising concerns about focused attacks on bespoke state systems.
The malware, dubbed NetamLoader, was detailed by Kaspersky. The company says it has identified at least one victim running a government-only Windows 10 build that isn’t available to ordinary users or businesses. The attackers behind the operation remain unknown.
According to Kaspersky’s analysis, NetamLoader takes advantage of legitimate components from Patch My PC, a widely used software update tool, to get a foothold on targeted machines. By piggybacking on trusted code, the malware is better positioned to avoid detection.
Once installed, NetamLoader hijacks .NET execution, the Microsoft framework that underpins many applications, to run its own instructions. It also bypasses the Anti-Malware Scan Interface (AMSI), which is supposed to scan scripts before they execute. After clearing those hurdles, it can load encrypted payloads, making it more difficult for defenders to see what the malware is doing.
From the viewpoint of a civil servant or contractor using the infected system, daily work would likely look normal. Updates appear to function, and applications open as expected, even as the loader quietly maintains a channel for whoever controls it.
Kaspersky’s report only confirms one victim so far, but security agencies often treat such initial sightings as possible test runs for wider campaigns. Writing a loader specifically for a government-only Windows build suggests that the attackers had prior knowledge of that environment and allocated significant effort to breaking into it.
The episode underlines the risks that come with relying on third-party tools in sensitive networks. Platforms like Patch My PC are meant to reduce exposure to vulnerabilities by keeping software current, yet they can also provide a convenient disguise for well-crafted malware.
Signals that would show this is part of a broader state-level operation include more reports of NetamLoader infections from other security firms, emergency advisories for government users of custom Windows builds, or technical disclosures from Patch My PC about any related compromise in its own infrastructure.
Sources
- OSINT