Hackers abuse Notepad++ plugins to stealthily install malware

Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.

The campaign has been attributed to a threat cluster tracked as UAC-0099, which primarily targets organizations in Ukraine and has previously been linked to providing initial access for attacks carried out byAPT44, also known as Sandworm.

The attackers do not exploit any vulnerability or a supply-chain compromise impacting the popular software.

Notepad++ attack chain

CERT-UA observed that UAC-0099 changed their modus operandi recently and now delivers a ZIP archive with a VBS script disguised as a PDF document. When launched, the PDF retrieves another compressed file named Evernote.zip.

The second archive contains a complete copy of the legitimate editor Notepad++ version 8.8.3, a malicious plugin (NppExport.dll), a password-protected archive (updater.rar), and the legitimate WinRAR executable.

The VBS script installs the package into a randomly named directory, launches Notepad++, and then loads the maliciousNppExport.dllvia the application’s normal plugin-loading mechanism.

CERT-UA explains that this DLL is LunchPoke, a tool that creates a scheduled task on Windows and extracts the contents of the RAR file, includingRemoteLibUpdater.exeandInitTest.dll.

The executable in the RAR file is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader.

BurnyBear also features a fallback mechanism in case launchingRemoteLibUpdater.exefails, triggering a resource exhaustion attack targeting the host’s RAM and CPU.

The latter creates another scheduled task, updates its configuration and command-and-control (C2) address, and then uses WinRAR to extract downloaded programs.

CERT-UA does not mention the final payloads delivered in the observed attacks, the purpose of the campaign, or the targeted organizations.

The researchers mentionCVE-2025-56383, a DLL hijacking flaw in Notepad++ v8.8.3, the exact version used in these attacks, but note that the Notepad++ team has disputed this issue, claiming that plugin loading is standard functionality.

CERT-UA advises system administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23, to prevent hackers from exploiting known flaws in existing products and enabling stealthy attacks.

Source