Malware Abuses Notepad++ Plugin System

Threat actors are masking malicious payloads within standard application environments to evade traditional detection methods. By bundling legitimate tools with custom-built utilities, adversaries are bypassing the need for initial exploit chains while maintaining persistent access on compromised machines.

The activity, which has been formally tracked by the Computer Emergency Response Team of Ukraine (CERT-UA), centers on the use of the Notepad++ text editor. Rather than targeting specific software vulnerabilities, this campaign relies on the inherent plugin-loading functionality of the application to execute malicious code within a trusted process.

Modus Operandi of UAC-0099

The campaign is attributed to a threat cluster designated as UAC-0099, a group known for its focus on Ukrainian targets. Historically, this group has functioned as an access broker, facilitating entry for the more advanced state-sponsored APT44, also referred to as Sandworm. The current operation demonstrates a shift in their operational tactics to include the abuse of legitimate software packages.

The attack begins when a target executes a VBS script masquerading as a PDF document. This script initiates the download of a compressed Evernote.zip archive. Upon extraction, the archive reveals a complete installation of Notepad++ version 8.8.3, paired with a malicious file disguised as a plugin named NppExport.dll. Once the legitimate text editor is launched, it automatically loads the rogue DLL, enabling the execution of LunchPoke, a utility designed to establish long-term persistence via Windows scheduled tasks.

Payloads and System Impact

Once active, the malicious plugin facilitates the extraction of a secondary, password-protected archive. This secondary stage introduces BurnyBear, a loader responsible for deploying the MatchBoil V2 malware. The operational flow is characterized by a high degree of modularity, allowing the attackers to update configurations and reach out to command-and-control servers as needed.

• Notepad++ version 8.8.3: The specific legitimate version bundled within the attack archive.
• CVE-2025-56383: A cited DLL hijacking vulnerability in the editor, which the developer asserts is standard, intended functionality.
• Version 8.9.7: The update version recommended by CERT-UA to mitigate risks related to this application.
• Version 26.02: The recommended update for the 7-Zip utility.
• Version 7.23: The recommended update for the WinRAR software.

The malicious suite also includes a defensive failsafe. Should the primary execution chain fail, the malware is programmed to initiate a resource exhaustion attack, intentionally overloading the host's CPU and RAM to mask secondary activities or disrupt system operations.

Stakes for Defense Teams

The core challenge for security operations lies in the attackers' reliance on legitimate software features rather than conventional exploits. Because the plugin-loading mechanism is an intended part of the software architecture, traditional signature-based detection may fail to flag the process as anomalous, even when it is acting as a conduit for secondary payloads like MatchBoil V2.

For organizations, this suggests that monitoring for the presence of software is insufficient. Security teams may need to shift focus toward behavioral analysis and strictly controlling which plugins are permitted to load within trusted applications. Further guidance on proactive testing of security controls can be found at Test every layer before attackers do. As researchers continue to analyze the campaign, the lack of identified final-stage payloads underscores the need for robust endpoint visibility to capture lateral movement or data exfiltration attempts that may follow the initial deployment of these loaders.