Cybersecurity researchers from Kaspersky have uncovered a sophisticated malware operation targeting government entities in Asia. This operation involves NetamLoader, a previously undocumented .NET assembly-loading framework, which has been used to attack a custom Windows 10 build exclusive to government organizations in the region. The malware was detected during the first half of 2026 and was found packaged inside a Windows cabinet archive file, strategically placed in directories meant for storing Windows operating system updates. This suggests a potential supply chain attack, where malicious actors gain access through a compromised third-party vendor.

The malware employs AppDomainManager injection, an adversarial technique that targets the .NET Framework's application-domain initialization to execute code covertly. This method allows malicious code to run within the process of a legitimate application, effectively evading detection. The CAB file involved in this attack contains seven files, with only one embedding malicious code, indicating a two-stage infection process. Notably, four of the files are legitimate components of Patch My PC, a known endpoint management software, further obfuscating the attack.

Kaspersky's telemetry data points to a single victim in Asia. While the exact country remains undisclosed, indications suggest China could be the target, given the customized Windows 10 build for government use. This aligns with recent reports of China's Ministry of State Security urging government agencies to transition from Windows to Chinese-made Linux distributions to enhance data security and reduce reliance on foreign technology. As countries develop their own software platforms, maintaining and securing these systems becomes a critical challenge.