As noted by The Record, suspected nation-state hackers have developed sophisticated malware designed to target a customized version of Windows used by government agencies in Asia.
The malware, identified as NetamLoader, utilizes legitimate Microsoft software components to execute malicious code and evade security detection. According to a report by Kaspersky, the operation likely involved a supply-chain attack, as the malware was discovered within a directory used for system updates. The package included files from the third-party tool Patch My PC alongside programs digitally signed by Microsoft. Once active, NetamLoader can interfere with security scanning, conceal its activity and delete system logs. It also possesses the capability to collect data and communicate with attacker-controlled infrastructure. Kaspersky detected the malware on one computer during the first half of 2026. While the specific government agency remains unidentified, the precision of the attack suggests the perpetrators possessed deep knowledge of the target's specialized technology. This incident highlights the security challenges inherent in customized operating systems, where individual nations maintain full autonomy over development and maintenance but must also manage the entire security ecosystem independently. Researchers have not yet confirmed if sensitive information was stolen or how the initial infection occurred.
Source: The Record
