‼️ An unknown APT group likely poisoned the supply chain of a custom Windows 10 build for Asian governments, Kaspersky says. Its NetamLoader malware hid in a Windows Update folder among real Patch My PC files and ran via Microsoft-signed .NET code.
Image from International Cyber Digest (@IntCyberDigest)
Image from International Cyber Digest (@IntCyberDigest)

Oct 29, 2026 · 4:08 PM UTC

11
72
3
500
35,728
RelevantRecentLikes
Source: securelist.com/netamloader/1… Our weekly newsletter: internationalcyberdigest.com…
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

Kaspersky researchers analyze a complex targeted attack employing NetamLoader, a sophisticated malicious framework and targeting a customized government OS.

securelist.com
2
13
4,209
Nobody audits the patch folder. That's the whole trick.
8
1,080
Custom government Windows builds are a dream target. Everyone trusts the image, nobody re-checks it. And "Microsoft-signed" only tells you who wrote the code, not what someone's making it do.
2
609
Signed .NET running out of a Windows Update folder would slip past most allowlists. I'd baseline what normally lives in those patch folders and alert on anything new.
1
1
625
It is good that Kaspersky found this bad software.
68
the malware was hiding among real files in a windows update folder the whole time and ran through microsoft signed code no surprise, signature checks often let that kind of thing through
299
Cyberspace Administration of China (CAC) is really cooking lately
769