Ukraine’s Computer Emergency Response Team (CERT-UA) has uncovered a new cyberattack campaign in which threat actors are abusing the legitimate Notepad++ text editor to secretly install malware on Windows systems.
The activity has been linked to the hacking group UAC-0099, a threat cluster known for targeting organizations in Ukraine and previously associated with providing initial access for attacks conducted by the Russian-linked Sandworm (APT44) group.
Unlike a traditional software supply chain attack, the attackers are not exploiting a vulnerability in Notepad++ or compromising the application’s official distribution. Instead, they trick victims into executing a malicious package that includes a legitimate copy of Notepad++ alongside malware disguised as one of its plugins.
According to CERT-UA, the attack begins with a ZIP archive containing a Visual Basic Script (VBS) file disguised as a PDF document. When opened, the script downloads another archive named Evernote.zip. That archive includes Notepad++ version 8.8.3, a malicious plugin named NppExport.dll, a password-protected archive called updater.rar, and a legitimate copy of WinRAR.
The VBS script installs these files into a randomly generated folder before launching Notepad++. During startup, the application automatically loads the fake plugin through its normal plugin mechanism, allowing the malware to execute without exploiting any security flaw.
CERT-UA identified the malicious DLL as LunchPoke, a persistence tool that creates a scheduled Windows task and extracts additional malware from the protected archive. The extracted files include RemoteLibUpdater.exe and InitTest.dll, with the executable acting as a loader known as BurnyBear. BurnyBear then launches another malware component called MatchBoil V2.
Researchers also discovered that BurnyBear contains a fallback mechanism. If it fails to execute its intended payload, it triggers a resource exhaustion attack that consumes large amounts of the victim’s CPU and memory. The malware then creates another scheduled task, updates its command-and-control server settings, and uses WinRAR to unpack additional files downloaded from the attackers.
CERT-UA has not disclosed the final malware payload delivered during the attacks, the specific objectives of the campaign, or the names of the organizations targeted.
The report also references CVE-2025-56383, a DLL hijacking issue affecting Notepad++ version 8.8.3, which is the same version included in the attack package. However, the Notepad++ developers have disputed the classification of the issue as a vulnerability, stating that loading plugins in this manner is expected application behavior.
As a precaution, CERT-UA recommends that organizations update Notepad++ to version 8.9.7, upgrade 7-Zip to version 26.02, and install WinRAR version 7.23 or later to reduce the risk of attackers abusing outdated software during similar intrusion attempts.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
