Notepad++ Under Attack: Fake Plugin Hides Malware

Hackers Are Turning Notepad++ Into a Silent Backdoor — Here's How the Attack Actually Works

Picture this: a system administrator in Kyiv opens an email that looks like an internal government order. There's an image attached — nothing unusual, just a scanned document preview. She clicks it. Thirty seconds later, a text editor she's used for a decade — Notepad++ — launches quietly on her screen. Nothing looks broken. No warning popup, no antivirus alert, no crash. And that's exactly the problem.

Behind the scenes, a scheduled task has already been created. A rogue DLL has loaded itself using the editor's own plugin system. And a loader is quietly waiting to pull down its next payload. This is the story of how the threat cluster tracked as UAC-0099 weaponized one of the most trusted developer tools on the planet — without touching a single line of Notepad++'s actual source code.

Table of Contents

• What Happened: The Core Attack
• Full Infection Chain, Step by Step
• Why This Isn't (Technically) a Notepad++ Vulnerability
• Malware Breakdown: LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2
• Indicators of Compromise (IOCs) and Key Artifacts
• Detection Techniques for SOC Teams
• Prevention and Hardening Recommendations
• Expert Tips From the Field
• Related Reading
• FAQ
• Final Takeaway

What Happened: The Core Attack

Ukraine's national CERT (CERT-UA) disclosed a new campaign in July 2026 tied to a long-running, Russia-aligned threat cluster it tracks as UAC-0099. This group has been active since at least mid-2022 and has a documented history of targeting Ukrainian state organizations, media entities, and even Ukrainian employees working remotely for companies based outside the country. In the past, the group has been linked to delivering initial access that fed into operations by APT44 (also known as Sandworm), and it previously abused a WinRAR flaw to drop a malware family called LONEPAGE.

What's different this time is the delivery mechanism. Instead of relying on a software vulnerability, UAC-0099 repackaged a completely legitimate, unmodified copy of Notepad++ version 8.8.3 alongside a trojanized plugin. When the victim runs the bundled Notepad++.exe, the editor does exactly what it's designed to do — it loads plugin DLLs from its plugins folder. Except one of those DLLs isn't a plugin at all. It's a malware loader.

Full Infection Chain, Step by Step

Here's how the attack unfolds from the victim's first click to full compromise:

1. Phishing delivery: The victim receives an email containing an embedded image, often styled to resemble an official government or municipal notice.
2. Redirect chain: Clicking the image routes through a URL-shortening service, which redirects to a public file-sharing platform hosting a ZIP archive (observed names include variations like "Attachments to Order.zip").
3. Disguised script: Inside the ZIP is a VBS script using a double-extension trick — padded with extra spaces so the filename appears to end in ".pdf" when it actually ends in ".vbs". Most users glancing at the filename in a file explorer window never see the real extension.
4. Payload staging: Once executed, the script drops a decoy document to keep the victim distracted, then silently downloads a second archive (packaged to look like an Evernote export) containing a full, legitimate copy of Notepad++ 8.8.3 and a tampered plugin directory.
5. Silent DLL sideload: The script launches notepad++.exe from a randomized folder under %PUBLIC%. Notepad++ automatically loads the plugin DLL sitting in its plugins folder — except this one has been swapped for a malicious file named NppExport.dll.
6. Persistence established: The malicious DLL extracts a password-protected RAR archive, drops additional executables, copies Windows' own schtasks.exe under a disguised name, and registers a scheduled task with a randomized name to relaunch the malware every three minutes.
7. Loader chain executes: The scheduled task repeatedly triggers a loader binary, which in turn loads an upgraded version of a known malware loader used by this same threat group in earlier campaigns.

Why This Isn't (Technically) a Notepad++ Vulnerability

This part matters for anyone writing an incident report. CERT-UA's findings echo a previously disputed issue referenced as CVE-2025-56383. However, the Notepad++ development team has pushed back on classifying this as a genuine vulnerability, describing DLL loading from the plugins directory as standard, documented plugin architecture — not a coding flaw.

In plain terms: Notepad++ isn't broken. The attackers aren't exploiting a bug. They're abusing a trust relationship — the same way a thief doesn't pick a lock if you've already handed them a key. This distinction matters because it shifts the defensive priority away from "patch Notepad++ and you're safe" and toward "control how software and archives arrive on your endpoints in the first place."

Malware Breakdown: LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2

CERT-UA assigned distinct internal codenames to each component of this toolchain, which helps analysts map the kill chain during investigation:

Component	File Name	Role
LUNCHPOKE	NppExport.dll	Trojanized Notepad++ plugin; initial payload dropper, extracts the password-protected archive and sets up scheduled-task persistence
BURNYBEAR	RemoteLibUpdater.exe	Loader for the next-stage DLL; includes a resource-exhaustion fallback routine if launched incorrectly (likely anti-analysis behavior)
MATCHBOIL.V2	InitTest.dll	Upgraded loader handling persistence, C2 configuration updates, and secondary payload delivery; now also leverages WinRAR to unpack components

MATCHBOIL.V2 is notable because it's a direct evolution of an older loader (MATCHBOIL) that CERT-UA had already linked to this same group, alongside other tools in their arsenal like MATCHWOK and DRAGSTARE. The upgraded version can pull WinRAR from a cloud storage service if it isn't already present on the target machine — a small but telling detail showing the group is engineering around missing dependencies rather than assuming a clean lab environment.

One quirky detail worth flagging for malware analysts: BURNYBEAR appears to include a built-in decoy mechanism. If it's executed without its expected command-line arguments (as would happen if a sandbox or analyst runs it manually), it deliberately consumes RAM and CPU instead of behaving normally. That's a deliberate anti-analysis trip wire, not a bug.

Indicators of Compromise (IOCs) and Key Artifacts

• ZIP archives referencing official-sounding government or municipal correspondence
• VBS scripts with padded filenames disguised as PDFs (extra spaces before the real extension)
• An archive disguised as an Evernote export containing a bundled Notepad++ 8.8.3 install
• NppExport.dll present in a Notepad++ plugins folder that wasn't installed via the official installer
• Notepad++.exe executing from a randomized directory under %PUBLIC%
• A hidden "Libraries" folder created under %PUBLIC%
• RemoteLibUpdater.exe and InitTest.dll present outside expected application directories
• schtasks.exe copied and renamed to disguise its purpose
• Scheduled tasks with randomized or nonsensical names re-triggering every three minutes with arguments like "setup nodisplay"

Detection Techniques for SOC Teams

If your organization runs Notepad++ across a large fleet (and let's be honest, most enterprises do), here's where to start hunting:

1. Hunt for Notepad++ launching from unusual paths

Legitimate installs run from Program Files. Anything launching from user-writable or public directories is worth a second look.

Get-Process notepad++ | Select-Object Path, Id, StartTime | Where-Object { $_.Path -notmatch "Program Files" }

What it does: Lists all running Notepad++ processes and their file paths, then filters for any instance not running from the expected Program Files location.
When to use it: As a scheduled endpoint sweep or ad-hoc hunt across your fleet.
Expected output: Ideally empty. Any result here warrants immediate triage.

2. Audit scheduled tasks for randomized or suspicious naming

Get-ScheduledTask | Where-Object { $_.TaskName -match "^[A-Za-z0-9]{6,}$" } | Select-Object TaskName, TaskPath, State

What it does: Surfaces scheduled tasks with short, randomized, alphanumeric names — a common pattern for malware persistence.
When to use it: During incident response or as part of regular endpoint hardening reviews.
Expected output: A short list of legitimate system tasks in most environments; anything unfamiliar should be investigated before removal.

3. Check for unauthorized DLLs in plugin directories

Compare file hashes of everything inside the Notepad++ plugins folder against a known-good baseline from the official installer. Any mismatch, especially on NppExport.dll, is a red flag.

4. Watch for schtasks.exe running under a renamed binary

Process-creation logging (Sysmon Event ID 1) combined with original filename metadata can expose a renamed copy of a legitimate Windows utility being used for persistence — a classic living-off-the-land technique.

Prevention and Hardening Recommendations

• Keep core utilities patched. As of late July 2026, the current secure versions are Notepad++ 8.9.7, WinRAR 7.23, and 7-Zip 26.02. The abused build in this campaign was three major versions behind current.
• Treat unsolicited ZIP attachments with suspicion, especially ones referencing government, legal, or municipal correspondence — a recurring social-engineering theme for this threat group.
• Enforce application allow-listing so that only approved, digitally verified copies of tools like Notepad++ can execute, ideally installed via managed software deployment rather than user-downloaded ZIPs.
• Restrict execution from public and temp directories using policies like Windows Defender Application Control or AppLocker rules targeting %PUBLIC%, %TEMP%, and Downloads folders.
• Monitor plugin directories for any DLL not shipped by the official installer, and consider integrity monitoring on commonly abused, plugin-capable applications.
• Strengthen email filtering against link-shortener redirects that lead to public file-hosting services, a common initial-access pattern well beyond this one campaign.
• Log and alert on new scheduled tasks created outside of your standard change-management process.

Expert Tips From the Field

From a SOC analyst's chair, the most useful lesson here isn't about Notepad++ specifically — it's about trust boundaries. Any application that supports plugins, extensions, or add-ons (browsers, IDEs, text editors, media players) creates a legitimate loading mechanism that malware authors can quietly repurpose. The vendor didn't fail; the trust model was simply exploited exactly as designed.

A practical habit worth adopting: whenever you're triaging an alert involving a "known good" application behaving oddly, check what it loaded, not just whether it ran. Process creation alone won't catch this style of attack — you need DLL load telemetry (Sysmon Event ID 7) correlated against a hash baseline.

Related Cybersecurity Topics You Should Explore

• RefluXFS: The Silent Linux Bug Giving Hackers Root Access
  
• This Google AI Finds, Proves, and Patches Hacks — Automatically
  
• Claude Security: Anthropic's AI Now Hunts Code Bugs
  
• Meta Paid $78K for a Bug That Exposed Your Private Chats
  
• Gemini 3.5 Flash Cyber: Google's AI Vulnerability Hunter
  
• CVE-2026-42533: The 15-Year-Old NGINX Bug Behind Pre-Auth RCE
  
• 15 Ways to Make Money in Cybersecurity in 2026 (Ranked)
  
• How Hackers Get Caught: 15 Free Email Investigation Tools 2026
  
• wp2shell: The WordPress Bug That Needs No Login to Hack You
  
• TP-Link Camera Flaw Lets Hackers on Your Wi-Fi Steal Admin Access
  
• Microsoft's Biggest Patch Tuesday Ever: 570 Bugs, 3 Zero-Days Exploited
  
• SonicWall SMA1000 Under Attack — Critical CVSS 10.0 Flaw Exposed
  
• Why SOC Analysts Run 'Tree' Before Anything Else

FAQ

Q: Is this a Notepad++ supply-chain compromise?
No. The attackers are not distributing a tampered official installer or compromising Notepad++'s build pipeline. They bundle a clean copy of the application alongside a malicious plugin file delivered separately through phishing.

Q: Do I need to uninstall Notepad++ to stay safe?
No. Users running Notepad++ installed through official channels and kept up to date are not inherently at risk from this specific campaign. The danger comes from running a version bundled inside an untrusted ZIP archive.

Q: What is UAC-0099?
It's a threat cluster tracked by CERT-UA since 2023, associated with espionage-motivated attacks against Ukrainian organizations and previously linked to providing initial access for the Sandworm-associated group APT44.

Q: What does LUNCHPOKE actually do?
It's the codename CERT-UA assigned to the malicious plugin DLL (NppExport.dll). It sets up a hidden working directory, extracts a password-protected archive, and establishes scheduled-task persistence.

Q: Why does BURNYBEAR consume CPU and RAM?
When executed without its expected arguments — as would happen in a sandbox or during manual analysis — BURNYBEAR appears to switch into a resource-exhaustion routine, likely as an anti-analysis or decoy behavior.

Q: Is CVE-2025-56383 a real vulnerability?
It's disputed. CERT-UA references it, but the Notepad++ maintainers describe the underlying plugin-loading behavior as intended architecture rather than a security flaw.

Q: Who is being targeted?
CERT-UA's disclosure focuses on organizations in Ukraine, though the group has a history of also targeting Ukrainian employees working remotely for companies headquartered elsewhere.

Final Takeaway

This campaign is a reminder that "trusted software" and "safe software" aren't always the same thing. UAC-0099 didn't need a zero-day. They needed a phishing email, a ZIP archive, and an application willing to load whatever sits in its plugins folder — which describes a huge percentage of the software running on enterprise endpoints today.

If your organization relies on Notepad++ or similar plugin-capable tools, now's the time to check your patch levels, review your plugin directories, and make sure your detection stack is watching DLL loads, not just process launches.

Found this breakdown useful? Share it with your SOC team, drop your own detection ideas in the comments, and subscribe for the next deep dive into how real-world threat clusters operate.