Hackers Abuse Notepad++ Plugins to Stealthily Install Malware
Threat actors are exploiting the popular Notepad++ text editor by bundling legitimate application installers with malicious plugins to establish persistence and deploy malware.
Cybersecurity researchers have uncovered a new attack campaign where threat actors are leveraging the widely-used Notepad++ text editor to distribute malware. The campaign, attributed to a threat cluster known as UAC-0099, primarily targets organizations within Ukraine and has previously been linked to providing initial access for attacks by the APT44 group, also known as Sandworm. Notably, this attack does not exploit any vulnerabilities within Notepad++ itself or its supply chain.
The modus operandi involves distributing a ZIP archive containing a VBS script disguised as a PDF document. Upon execution, this script downloads another compressed file, named Evernote.zip. This second archive is more elaborate, containing a complete, legitimate version of Notepad++ (specifically version 8.8.3), a malicious plugin file named NppExport.dll, a password-protected RAR archive, and the legitimate WinRAR executable.
Once deployed, the VBS script installs this package into a randomly named directory on the victim's system. It then launches the Notepad++ application, which in turn loads the malicious NppExport.dll through the editor's standard plugin-loading mechanism. This DLL is identified as LunchPoke, a tool designed to establish persistence by creating a scheduled task on Windows. It also extracts the contents of the RAR archive, which include RemoteLibUpdater.exe and InitTest.dll.
The executable extracted from the RAR file is BurnyBear, which functions as a loader for the MatchBoil V2 malware loader. BurnyBear also includes a fallback mechanism that can trigger a resource exhaustion attack, targeting the host's RAM and CPU, if the primary execution path fails. The subsequent component, RemoteLibUpdater.exe, creates another scheduled task, updates its command-and-control (C2) configuration, and then uses the legitimate WinRAR executable to unpack further downloaded malicious programs.
While the specific final payloads and the ultimate objectives of this campaign remain undisclosed by CERT-UA, the researchers did note a potential connection to CVE-2025-56383, a DLL hijacking flaw in Notepad++ version 8.8.3. However, the Notepad++ development team has reportedly disputed this specific vulnerability, stating that the observed behavior is consistent with standard plugin loading functionality.
To mitigate these threats, CERT-UA recommends that system administrators update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23. These updates address known vulnerabilities in the respective software that could be exploited by threat actors to facilitate stealthy attacks and malware deployment.
This campaign highlights a concerning trend where legitimate software and its features are being co-opted by threat actors to bypass security measures and establish a foothold within target environments. The use of a popular, trusted application like Notepad++ as a delivery vehicle for malware underscores the need for continuous vigilance and robust endpoint security solutions.
This new report from Cyber Security News details a specific campaign by the UAC-0099 threat cluster that leverages a trojanized NppExport.dll within Notepad++ version 8.8.3. The campaign uses a VBS script disguised as a PDF to deliver the malicious plugin, which then executes malware silently upon Notepad++ startup. The identified tools include LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2, with persistence achieved via scheduled tasks and C2 communication potentially using WinRAR and Dropbox.