Notepad++ Plugin Exploited in Espionage Campaign Targeting Ukraine
CERT-UA has alerted organizations about the UAC-0099 threat cluster, which is leveraging the normal plugin-loading behavior of Notepad++ to execute an espionage campaign against targets in Ukraine. This operation involves packaging a legitimate version of Notepad++ 8.8.3 with a malicious plugin, allowing the attackers to mask their activities as trusted software execution rather than traditional malware deployment. It is important to note that this situation does not stem from a vulnerability in Notepad++ or a confirmed supply-chain compromise; instead, it is a sideloading operation that exploits the application's established trust.
The infection process typically begins with a phishing email that contains an image and a shortened link to a file-sharing service. When users click the link, they download a ZIP archive that includes a double-extension VBScript disguised as a PDF file. Running this script displays a decoy document while simultaneously downloading another archive named Evernote.zip. This archive installs Notepad++ along with the malicious DLL, as well as a password-protected RAR file and, if necessary, a WinRAR executable sourced either locally or from Dropbox.
The malicious DLL, identified as LunchPoke and named NppExport.dll, creates a scheduled task and extracts subsequent components. Among these components is BurnyBear, which loads the MatchBoil V2 loader from InitTest.dll. This enables the attackers to perform configuration updates, change command-and-control settings, and download additional payloads. To mitigate the risk, Windows administrators are urged to update Notepad++ to at least version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23. They should also investigate any unexpected Notepad++ plugins, unusually named installation folders, scheduled tasks, and any archive extraction activities that appear suspicious.
