Listen to this Post
Introduction: When Everyday Applications Become Cyber Weapons
Cybercriminals are constantly searching for new ways to bypass security solutions, and one of their most effective strategies is abusing software that organizations already trust. Instead of relying on suspicious executables that trigger antivirus alerts, attackers increasingly leverage legitimate applications as malware launchers, allowing malicious code to blend seamlessly into normal system activity.
A newly disclosed investigation by CERT-UA demonstrates exactly how dangerous this trend has become. The Ukrainian cybersecurity agency has uncovered a major evolution in the operations of the threat cluster UAC-0099, revealing an advanced malware delivery chain built around a genuine Notepad++ 8.8.3 installation. Rather than exploiting a software vulnerability in the traditional sense, the attackers abuse Notepad++’s legitimate plugin architecture to sideload malicious DLLs, introducing new malware components including LUNCHPOKE, BURNYBEAR, and an upgraded MATCHBOIL.V2 loader.
The campaign highlights a broader reality facing organizations worldwide: trusted software is no longer automatically trustworthy when attackers can manipulate how it is installed, configured, or launched.
CERT-UA Reveals a Major Evolution in UAC-0099 Operations
CERT-UA reports that the campaign has been active since the middle of 2026 and represents a significant upgrade over previous UAC-0099 phishing operations that primarily targeted Ukraine’s defense sector.
Earlier campaigns relied heavily on the MATCHBOIL and MATCHWOK malware families. The latest operation dramatically expands the infection chain by introducing several new malware components designed to improve stealth, persistence, and payload delivery.
Rather than depending on obvious malware downloaders, the attackers now use legitimate software as camouflage, making detection significantly more difficult for endpoint security platforms.
The Attack Begins with a Carefully Crafted Phishing Email
Like many advanced attacks, the intrusion starts with a convincing phishing email.
Victims receive an email containing what appears to be an embedded image. Clicking the image silently redirects users through a shortened URL toward a file-hosting service that downloads an archive with an innocent-looking name such as:
Additions to the Order.zip
Everything appears routine, encouraging recipients to continue interacting with the files without suspicion.
Double Extension Tricks Continue to Fool Users
Inside the downloaded archive is a Visual Basic Script (VBS).
Instead of presenting itself honestly, the attackers pad the filename with dozens of blank spaces before the final “.vbs” extension. As a result, Windows Explorer displays what appears to be a harmless PDF document.
Example:
Invoice.pdf .vbs
Most users only see:
Invoice.pdf
This classic social engineering technique continues to be remarkably effective because it exploits human trust rather than software vulnerabilities.
The Fake PDF Starts the Multi-Stage Infection
Once the disguised script is executed, several actions occur almost instantly.
The malware:
Opens a harmless decoy PDF.
Extracts another archive.
Creates randomized working directories.
Launches additional malware in the background.
The victim believes they simply opened a document while the real infection quietly progresses.
Legitimate Notepad++ Becomes the Perfect Malware Launcher
The second archive, named Evernote.zip, contains a complete and legitimate installation of Notepad++ 8.8.3.
Nothing about the executable itself has been modified.
Instead, attackers bundle the software with a malicious plugin named:
NppExport.dll
Because Notepad++ automatically loads plugins from its designated plugins directory, Windows happily launches both the authentic editor and the attacker’s DLL simultaneously.
This approach abuses expected software behavior rather than exploiting memory corruption or code execution flaws.
Plugin Sideloading Sparks Security Debate
CERT-UA notes that the technique has generated discussion surrounding CVE-2025-56383.
However, Notepad++ developers maintain that automatic plugin loading is an intentional architectural feature—not a security vulnerability.
This distinction is important.
The software behaves exactly as designed.
The attackers simply leverage that behavior to execute malicious code.
This differs significantly from earlier Notepad++ supply-chain incidents involving compromised update infrastructure, where users unknowingly downloaded altered software directly from trusted distribution channels.
LUNCHPOKE: The First Malware Component
The malicious DLL loaded by Notepad++ is tracked as:
LUNCHPOKE
Its responsibilities include:
Extracting password-protected archives
Deploying secondary malware
Preparing persistence
Launching follow-on payloads
It specifically extracts an archive called:
updater.rar
containing:
RemoteLibUpdater.exe
InitTest.dll
Scheduled Tasks Provide Long-Term Persistence
Rather than running malware directly every time, the attackers copy the legitimate Windows utility:
schtasks.exe
Using
This persistence method blends into normal Windows administration activity, making it difficult for defenders to distinguish malicious scheduled tasks from legitimate enterprise automation.
BURNYBEAR Introduces Anti-Analysis Features
The secondary executable RemoteLibUpdater.exe has been identified as:
BURNYBEAR
Its primary role is to launch the final malware payload.
Interestingly, CERT-UA discovered that if analysts execute BURNYBEAR incorrectly or without expected parameters, the program deliberately consumes excessive CPU and memory resources.
Possible objectives include:
confusing malware analysts,
wasting sandbox execution time,
disrupting automated malware analysis systems,
hiding actual functionality behind misleading behavior.
Such defensive coding techniques are increasingly common among sophisticated threat actors.
MATCHBOIL.V2 Expands the Original Loader
The final component, InitTest.dll, represents an upgraded version of the MATCHBOIL malware family.
Known as:
MATCHBOIL.V2
It retains all previous capabilities while introducing major improvements.
New features include:
automated WinRAR extraction,
payload staging,
updated command-and-control communications,
remote configuration updates,
automatic WinRAR downloads from Dropbox if the utility is missing,
improved payload deployment.
These enhancements allow attackers to maintain flexibility across different victim environments.
Evolution from Earlier UAC-0099 Malware
Previous generations of MATCHBOIL primarily focused on downloading payloads and communicating with command-and-control infrastructure using hardware-derived identifiers embedded within HTTP headers.
MATCHBOIL.V2 expands those capabilities into a more modular framework capable of adapting to multiple victim configurations without requiring manual operator intervention.
This evolution reflects the increasing sophistication of
Understanding Each Malware Component
The malware chain can be summarized as follows:
LUNCHPOKE – Malicious DLL disguised as a legitimate Notepad++ plugin responsible for initiating the attack.
BURNYBEAR – Secondary loader responsible for launching additional malware while providing anti-analysis behavior.
MATCHBOIL.V2 – Final-stage loader that manages payload extraction, persistence, remote updates, and malware deployment.
Together, these components form a resilient, modular attack framework capable of maintaining persistence while remaining difficult to detect.
Keeping Software Updated Is More Important Than Ever
CERT-UA recommends organizations immediately update commonly deployed utilities.
As of July 2026, recommended versions include:
Notepad++ 8.9.7
WinRAR 7.23
7-Zip 26.02
Although the attackers abused version 8.8.3, the larger lesson extends beyond one application.
Any trusted software that automatically loads extensions, plugins, modules, or libraries can become an attractive target if organizations continue operating outdated versions or fail to monitor application integrity.
Deep Analysis
This campaign illustrates a growing trend in modern cyber warfare: abusing legitimate software instead of exploiting traditional vulnerabilities. The attackers never needed to modify Notepad++. They simply relied on its expected plugin-loading behavior, allowing malicious code to execute under the guise of a trusted application.
From a Security Operations Center (SOC) perspective, this technique is particularly dangerous because endpoint detection systems often whitelist signed applications like Notepad++. Once Notepad++ starts, defenders may only see a normal process tree unless DLL loading, plugin directories, and scheduled tasks are closely monitored.
Administrators should proactively hunt for suspicious plugin directories, unauthorized DLL files, and abnormal scheduled tasks. Useful Windows commands include:
List scheduled tasks
schtasks /query /fo LIST /v
Search for suspicious DLL files
Get-ChildItem "C:\Program Files\Notepad++" -Recurse -Filter .dll
Display running Notepad++ processes
tasklist | findstr notepad++
Verify digital signatures
Get-AuthenticodeSignature "C:\Program Files\Notepad++ otepad++.exe"
Monitor recently created scheduled tasks
wevtutil qe Microsoft-Windows-TaskScheduler/Operational /f:text /c:50
Inspect startup persistence
reg query HKCUSoftwareMicrosoftWindowsCurrentVersionRun
reg query HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Search for suspicious archives
dir /s .rar
dir /s .zip
Identify unsigned DLLs
Get-ChildItem -Recurse .dll | Get-AuthenticodeSignature
Security teams should also deploy application allowlisting, enable PowerShell logging, monitor DLL sideloading events, enforce software inventory management, and regularly validate the integrity of plugins installed within trusted applications. Behavioral detection is becoming far more valuable than signature-based antivirus as attackers increasingly hide inside legitimate software ecosystems.
What Undercode Say:
The latest CERT-UA findings reinforce one of the biggest shifts occurring in offensive cyber operations: attackers are no longer dependent on discovering zero-day vulnerabilities to compromise organizations. Instead, they are exploiting trust itself.
UAC-0099 demonstrates careful operational maturity.
Their infection chain is modular.
Each stage has a specific responsibility.
Every component minimizes unnecessary exposure.
Using a genuine Notepad++ executable immediately reduces suspicion.
Plugin sideloading avoids exploiting memory corruption.
Legitimate Windows tools provide persistence.
Scheduled tasks appear normal to administrators.
Password-protected archives complicate forensic analysis.
Randomized extraction folders reduce detection signatures.
Resource exhaustion functions waste analyst time.
MATCHBOIL.V2 shows continuous malware development.
Automatic dependency downloads improve operational reliability.
Dropbox integration demonstrates flexible infrastructure usage.
The campaign emphasizes defense evasion over exploitation.
Human psychology remains the initial attack vector.
Email phishing continues delivering excellent attacker success rates.
Outdated software increases operational risk.
Plugin ecosystems deserve greater security scrutiny.
Application trust should never be unconditional.
Security teams should baseline legitimate plugins.
DLL integrity monitoring is becoming essential.
Scheduled task auditing should be routine.
Behavioral analytics outperform static signatures here.
SOC analysts must correlate multiple telemetry sources.
Process ancestry provides valuable investigative context.
Unsigned DLL loading should trigger alerts.
Living-off-the-land techniques continue expanding.
Legitimate binaries remain attractive malware hosts.
Threat actors increasingly favor stealth over speed.
Persistence mechanisms are becoming quieter.
Attack chains are becoming more automated.
Detection requires visibility across endpoints.
Supply-chain awareness remains critical.
Software architecture can be abused without being vulnerable.
Organizations must monitor trusted applications continuously.
Threat hunting should include plugin directories.
Regular software updates reduce available attack surfaces.
User awareness remains a vital defensive layer.
Incident response playbooks should cover DLL sideloading scenarios.
The distinction between “feature” and “vulnerability” matters less when attackers successfully weaponize legitimate functionality.
Future campaigns will likely expand these techniques to other extensible applications with plugin ecosystems.
✅ Confirmed: CERT-UA documented a new UAC-0099 campaign using a legitimate Notepad++ 8.8.3 executable alongside newly identified malware components LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2.
✅ Confirmed: The attack abuses Notepad++’s plugin-loading mechanism for DLL sideloading rather than exploiting a traditional software vulnerability, aligning with the developers’ position that plugin loading is intentional behavior.
✅ Confirmed: The campaign relies on phishing emails, disguised VBS scripts, scheduled-task persistence, and multiple malware stages, reflecting a sophisticated and well-documented infection chain aimed at improving stealth and long-term access.
Prediction
(+1) Security vendors will increasingly introduce behavioral detections focused on plugin abuse, DLL sideloading, and trusted application monitoring rather than relying solely on malware signatures. As organizations strengthen visibility into legitimate software ecosystems, attackers will face greater difficulty hiding inside common utilities like Notepad++, driving both defenders and threat actors toward an ongoing cycle of increasingly sophisticated detection and evasion techniques.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
