Cyberattackers have been discovered using a clever tactic to stealthily install malware on unsuspecting computers, exploiting the trust placed in popular software Notepad++. The attackers, linked to a threat cluster tracked as UAC-0099, have been targeting organizations primarily based in Ukraine. This campaign marks a shift in tactics for the group, which has previously provided initial access for attacks carried out by APT44, also known as Sandworm.
The attack chain begins with an archive containing Notepad++ and a malicious utility called LunchPoke disguised as a plugin to establish persistence. The attackers do not exploit any vulnerability or supply-chain compromise in Notepad++, but instead rely on social engineering tactics to trick victims into installing the malware. When launched, the malware retrieves another compressed file named Evernote.zip, which contains a complete copy of the legitimate editor, along with the malicious NppExport.dll plugin and other tools.
The VBS script installs the package into a randomly named directory, launches Notepad++, and then loads the malicious NppExport.dll via the application’s normal plugin-loading mechanism. This DLL is LunchPoke, a tool that creates a scheduled task on Windows and extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll. The latter is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader.
BurnyBear also features a fallback mechanism in case launching RemoteLibUpdater.exe fails, triggering a resource exhaustion attack targeting the host’s RAM and CPU. This creates another scheduled task, updates its configuration and command-and-control (C2) address, and then uses WinRAR to extract downloaded programs. While CERT-UA has not disclosed the final payloads delivered in the observed attacks or the purpose of the campaign, it is clear that this tactic allows attackers to maintain persistence on compromised systems.
The researchers have also mentioned CVE-2025-56383, a DLL hijacking flaw in Notepad++ v8.8.3, but note that the Notepad++ team has disputed this issue, claiming that plugin loading is standard functionality. However, CERT-UA advises system administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23, to prevent hackers from exploiting known flaws in existing products.
This attack serves as a reminder that even seemingly legitimate software can be exploited by attackers if not properly secured. It highlights the importance of keeping software up-to-date, but also underscores the need for more robust security measures to detect and prevent such attacks. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and test every layer of their defenses before attackers do.
Source: Bleeping Computer — 2026-07-23