A sophisticated cyberattack has been uncovered, with hackers using legitimate software plugins to stealthily install malware on target systems. The attackers have been linked to a threat cluster tracked as UAC-0099, which primarily targets organizations in Ukraine and has previously been associated with providing initial access for attacks carried out by APT44.
The campaign involves the distribution of an archive containing the popular Notepad++ text editor and a malicious utility called LunchPoke disguised as a plugin. The attackers do not exploit any vulnerability or supply-chain compromise impacting the software, but rather use social engineering tactics to trick victims into installing the malware. This approach allows them to maintain a low profile and avoid detection.
The attack chain begins with the delivery of a ZIP archive containing a VBS script disguised as a PDF document. When launched, the script retrieves another compressed file named Evernote.zip, which contains a complete copy of Notepad++ version 8.8.3, along with a malicious plugin (NppExport.dll) and other files. The script then installs the package into a randomly named directory, launches Notepad++, and loads the malicious NppExport.dll via the application’s normal plugin-loading mechanism.
The LunchPoke utility creates a scheduled task on Windows and extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll. BurnyBear, another component in the malware, serves as a loader for the DLL file that is ultimately the MatchBoil V2 malware loader. This tool also features a fallback mechanism that triggers a resource exhaustion attack targeting the host’s RAM and CPU if launching RemoteLibUpdater.exe fails.
The exact payloads delivered in these attacks and the purpose of the campaign remain unclear. However, CERT-UA advises system administrators to update Notepad++ to version 8.9.7, as well as other software components, to prevent hackers from exploiting known flaws in existing products and enabling stealthy attacks. This is a timely reminder for organizations to stay vigilant and regularly review their security configurations.
In light of this attack, it’s essential for system administrators to remain proactive and keep their software up-to-date. Regularly reviewing and updating plugins can help mitigate the risk of such stealthy attacks. Furthermore, considering the use of breach and attack simulation tools can also enhance an organization’s ability to detect and respond to these types of threats. By taking a proactive approach to security, organizations can reduce their vulnerability to such sophisticated cyberattacks.
Source: Bleeping Computer — 2026-07-23