NetamLoader Malware Exploits Custom Government Windows 10 Build Across Asian Agencies

Cybersecurity firm Kaspersky has uncovered a complex malware campaign, dubbed NetamLoader, that specifically targets a customized version of Windows 10 deployed by government bodies in several Asian nations. The malicious code leverages .NET injection techniques to infiltrate systems that are otherwise considered hardened against conventional threats.

According to the technical brief released this week, the attackers first gain a foothold through a seemingly legitimate software update, after which a tailored loader injects malicious .NET assemblies into the operating system. This approach allows the payload to execute with the same privileges as the host application, effectively bypassing many traditional security controls that focus on native executable binaries.

The infection chain is described as “highly sophisticated” because it combines multiple evasion layers, including code obfuscation, dynamic API resolution, and the use of a bespoke Windows 10 build that differs from publicly available versions. By tailoring the malware to this specific environment, the authors increase their chances of remaining undetected while maintaining persistent access to sensitive government networks.

Experts note that the focus on a government‑only Windows variant signals a deliberate reconnaissance effort, likely aimed at gathering intelligence or preparing for future disruptive actions. The campaign’s geographic concentration in Asia aligns with broader trends of state‑aligned threat actors seeking to exploit regional supply‑chain weaknesses and the rapid digitization of public services.

Kaspersky’s findings underscore the importance of rigorous patch management and the deployment of application whitelisting, especially for custom operating system images. Security teams are advised to monitor for anomalous .NET processes, verify the integrity of software updates, and employ behavior‑based detection tools that can spot the unusual injection patterns employed by NetamLoader.

The disclosure comes amid growing concerns over the resilience of critical infrastructure to advanced persistent threats. While no public attribution has been made, the sophistication of the technique suggests involvement of well‑resourced actors. Authorities in the affected countries are expected to issue advisories and may consider broader collaboration with international cybersecurity agencies to mitigate the risk and share indicators of compromise.