Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
A Russia-aligned threat group, UAC-0099, is distributing a malicious Notepad++ plugin to deliver the MATCHBOIL.V2 malware, building on previous campaigns.
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified a new campaign orchestrated by a Russia-aligned threat group, tracked as UAC-0099, which is distributing a malicious program disguised as a Notepad++ plugin to compromise Windows systems. This campaign represents an evolution of the group's tactics, building upon previous activities where they exploited WinRAR vulnerabilities to deploy malware.
UAC-0099 has been active since at least mid-2022 and has previously been observed using phishing emails as an initial access vector to deploy various malware strains, including MATCHBOIL, MATCHWOK, and DRAGSTARE. In earlier attacks, the group weaponized security flaws in WinRAR software to deliver a malware strain known as LONEPAGE. The latest observed campaign, which began earlier this summer, starts with a phishing email containing an image attachment. Upon clicking this attachment, a URL concealed by a link shortener is opened, leading to a file-sharing service like EasySend[.]co where a ZIP archive is retrieved.
This ZIP archive contains a Visual Basic Script (VBScript) that masquerades as a PDF document. When the victim attempts to open the VBScript, it triggers a distraction mechanism by downloading and displaying a decoy PDF. Simultaneously, it silently downloads a second archive named "Evernote.zip." This archive contains several critical components: a complete copy of the legitimate Notepad++ editor (version 8.8.3), a malicious DLL plugin named "NppExport.dll," a password-protected archive "updater.rar," and a legitimate WinRAR executable "winrar.exe."
The primary objective of the VBScript is to extract the contents of the "updater.rar" archive and then launch Notepad++. Upon execution, Notepad++ loads the malicious "NppExport.dll" plugin, codenamed LUNCHPOKE. This DLL is designed to unpack the "updater.rar" archive, which contains "RemoteLibUpdater.exe" and "InitTest.dll." It then establishes persistence by creating a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
The "RemoteLibUpdater.exe" binary, identified as BURNYBEAR, acts as a loader for "InitTest.dll." This DLL is a modified version of MATCHBOIL, a C#-based loader known for its capability to deliver secondary payloads. The new iteration has been specifically codenamed MATCHBOIL.V2. CERT-UA noted that if "RemoteLibUpdater.exe" is launched incorrectly, without specific arguments, BURNYBEAR activates a logic designed to exhaust the computer's resources, including RAM and processor.
CERT-UA recommends that organizations update their WinRAR, 7-Zip, and Notepad++ software to the latest versions to mitigate the risk of threat actors exploiting known vulnerabilities. This advisory highlights the ongoing efforts by UAC-0099 to leverage legitimate software and social engineering tactics to compromise systems, underscoring the need for continuous vigilance and prompt patching.
The broader context of this attack includes recent advisories from U.S. government agencies regarding similar Russian-aligned threat activities. For instance, the threat actor Laundry Bear (also known as Void Blizzard) has been targeting Zimbra webmail servers with "half-click" exploits, and Proofpoint has reported on Operation RoundPress, where Russian threat actors use webmail targeting with cross-site scripting (XSS) exploits to siphon data. These campaigns, often targeting Ukrainian entities first, demonstrate a trend of Russian cyber threat groups using Ukraine as a testing ground before broader global deployment, aligning with espionage objectives.