Listen to this Post
Introduction: A Familiar Application Turned Into an Unexpected Threat
Cybercriminals have long understood that trust is one of the strongest weapons in digital warfare. Instead of relying on sophisticated software vulnerabilities or zero-day exploits, modern attackers increasingly abuse legitimate applications that millions of users install every day. The latest investigation by Ukraine’s Computer Emergency Response Team (CERT-UA) demonstrates exactly how dangerous this tactic has become.
In a newly uncovered cyber campaign, attackers disguised malicious components as legitimate Notepad++ plugins, allowing malware to execute under the cover of trusted software. Rather than compromising the official Notepad++ project or exploiting an unknown vulnerability, the attackers simply packaged genuine software alongside malicious files, creating an infection chain that appears completely harmless at first glance.
The campaign has been linked to the threat cluster known as UAC-0099, a group already associated with cyber operations targeting Ukrainian organizations and believed to provide initial access for the Russian state-linked threat actor APT44 (Sandworm). The discovery highlights an important shift in cyber warfare: attackers no longer need to hack trusted software—they only need victims to trust it.
Campaign Overview
Ukraine’s CERT-UA discovered a malware campaign distributing a ZIP archive containing the legitimate Notepad++ version 8.8.3 together with a malicious dynamic-link library (DLL) named NppExport.dll. While the DLL masquerades as a normal Notepad++ plugin, it actually contains malware known as LunchPoke, designed to establish long-term persistence on compromised Windows systems.
Unlike many modern attacks, this campaign does not exploit a software vulnerability, compromise the Notepad++ supply chain, or modify the official application. Instead, it abuses Windows’ normal plugin loading mechanism to execute malicious code.
This subtle distinction makes the campaign especially dangerous because many security teams primarily focus on exploit detection while overlooking attacks that leverage legitimate software behavior.
How the Infection Begins
The attack starts with what appears to be a harmless ZIP archive containing a Visual Basic Script (VBS) disguised as a PDF document.
Once the victim opens the fake PDF, the embedded VBS script silently downloads another archive named Evernote.zip.
Although the filename suggests another trusted productivity application, it actually serves as the second stage of the malware deployment process.
This social engineering approach allows attackers to bypass many traditional security controls because the initial files appear completely legitimate.
Inside the Second Archive
The downloaded archive contains several carefully selected components that work together throughout the attack:
Legitimate Notepad++ v8.8.3
Malicious NppExport.dll
Password-protected archive updater.rar
Legitimate WinRAR executable
The VBS installer extracts everything into a randomly generated directory before launching Notepad++.
Since Notepad++ automatically loads plugins during startup, Windows treats the malicious DLL exactly as it would any legitimate extension.
From the
LunchPoke Establishes Persistence
Once loaded, the malicious DLL executes the LunchPoke malware.
Its primary responsibility is persistence.
LunchPoke creates scheduled Windows tasks that automatically restart malicious components after every system reboot.
It then extracts the password-protected archive using the bundled WinRAR executable.
Inside the archive are two additional components:
RemoteLibUpdater.exe
InitTest.dll
These files represent the next stage of the malware chain.
By relying on scheduled tasks instead of startup folders or registry keys alone, the attackers improve the resilience of their infection while reducing detection rates.
BurnyBear and MatchBoil V2 Take Control
The executable RemoteLibUpdater.exe is actually known as BurnyBear, a malware loader responsible for launching another payload called MatchBoil V2.
MatchBoil functions as the primary malware loader capable of downloading additional tools from attacker-controlled command-and-control (C2) servers.
This layered architecture provides attackers with remarkable flexibility.
Instead of embedding all malicious functionality inside one executable, they deploy lightweight loaders capable of retrieving updated malware whenever required.
Such modular designs are common among advanced persistent threat (APT) groups because they simplify updates while reducing forensic evidence.
A Resource Exhaustion Fallback Mechanism
CERT-UA also observed an unusual defensive capability built into BurnyBear.
If RemoteLibUpdater.exe cannot execute correctly, BurnyBear deliberately launches a resource exhaustion attack against the infected computer.
This mechanism aggressively consumes system memory (RAM) and CPU resources.
Although this behavior may appear destructive, it can also complicate forensic investigations, destabilize analysis environments, and disrupt endpoint security products attempting to inspect the malware.
Such contingency mechanisms are increasingly common in sophisticated malware families.
Maintaining Long-Term Access
Following successful deployment, the malware creates additional scheduled tasks and updates its internal configuration.
It can also modify its command-and-control server addresses whenever necessary, allowing operators to continue communicating with infected systems even if previous infrastructure is blocked.
Using WinRAR, the malware extracts newly downloaded payloads directly onto compromised hosts.
CERT-UA has not yet disclosed the final payloads observed during the campaign, nor has it revealed the exact organizations targeted.
However, given
No Exploit Required
One particularly important aspect of this campaign is what it doesn’t use.
There is:
No zero-day exploit
No supply-chain compromise
No hacked Notepad++ installer
No malicious update server
Instead, attackers simply package authentic software with malicious plugins.
This demonstrates that trusted software ecosystems can still be abused without compromising the software vendor itself.
Security awareness remains one of the strongest defenses against these attacks.
The Debate Around CVE-2025-56383
CERT-UA referenced CVE-2025-56383, a reported DLL hijacking issue affecting Notepad++ version 8.8.3.
However, the Notepad++ developers dispute that characterization.
According to the project maintainers, the application loading plugins from its plugin directory is standard intended functionality rather than a security vulnerability.
This distinction matters because the malware does not rely on bypassing application security—it simply abuses expected behavior after convincing users to run the malicious package.
Recommended Security Updates
CERT-UA recommends administrators immediately update several widely used applications:
Notepad++ 8.9.7
7-Zip 26.02
WinRAR 7.23
Keeping software current reduces exposure to known vulnerabilities while improving compatibility with modern security protections.
Organizations should also monitor scheduled task creation, unusual plugin installations, unsigned DLL execution, and abnormal use of archive utilities.
Deep Analysis
This campaign demonstrates a textbook example of Living-Off-Trusted-Applications (LOTA) rather than Living-Off-the-Land (LotL). Instead of abusing built-in Windows binaries alone, attackers leverage the credibility of popular third-party software to lower suspicion. The plugin architecture of Notepad++ becomes an execution vector without requiring exploitation of the editor itself.
From a defensive perspective, endpoint detection should focus on behavioral indicators rather than application names. Security teams should monitor unexpected DLL loading within trusted applications, suspicious scheduled task creation, execution of VBS scripts from temporary directories, and archive extraction immediately followed by executable launches.
Useful investigation commands include:
schtasks /query /fo LIST /v
tasklist /m NppExport.dll
Get-ScheduledTask dir /s NppExport.dll Get-FileHash RemoteLibUpdater.exe netstat -ano
Get-WinEvent -LogName Security
wmic process get ProcessId,CommandLine
Incident responders should also compare legitimate Notepad++ plugin directories against approved baselines, inspect randomly named installation folders, collect memory dumps for forensic analysis, and monitor outbound connections to newly observed command-and-control infrastructure. Because the attack chain relies on multiple stages, interrupting any one of these stages can prevent the deployment of additional payloads.
What Undercode Say:
This campaign reflects a growing trend where attackers avoid expensive zero-day development and instead weaponize user trust. That strategy is often more effective because organizations tend to whitelist popular software while scrutinizing unknown executables.
The use of legitimate Notepad++ dramatically lowers suspicion.
Bundling genuine software with malware is becoming increasingly common.
Attackers understand that users rarely question trusted applications.
The plugin mechanism is abused rather than exploited.
This distinction is technically significant.
Detection becomes much more difficult.
Traditional antivirus solutions may initially classify the software as legitimate.
Behavioral analytics become the primary defense.
Scheduled tasks remain a favorite persistence method.
Layered malware architecture shows professional development practices.
BurnyBear functions as a modular loader rather than a complete malware package.
MatchBoil V2 enables rapid operational changes.
Infrastructure can be replaced without rebuilding malware.
The fake PDF demonstrates continued success of social engineering.
Users remain the weakest security layer.
Security awareness training is still essential.
Application allowlisting alone is insufficient.
Endpoint Detection and Response (EDR) visibility becomes critical.
Organizations should monitor DLL loading events.
Unsigned plugins deserve immediate investigation.
Random installation directories should trigger alerts.
Archive extraction followed by execution is suspicious.
Memory exhaustion routines indicate anti-analysis capabilities.
Attackers increasingly prepare contingency plans.
APT operators value resilience.
Command-and-control rotation improves campaign longevity.
Threat hunting should prioritize behavioral anomalies.
Windows scheduled tasks deserve continuous monitoring.
PowerShell logging should remain enabled.
Script execution policies should be reviewed.
VBS execution should be minimized where possible.
Application control policies can reduce risk.
Network segmentation limits lateral movement.
Threat intelligence sharing remains essential.
Rapid incident response reduces attacker dwell time.
The campaign demonstrates disciplined operational security.
Its modular design suggests long-term maintenance.
Future variants will likely target additional trusted software.
Organizations that rely solely on signature detection will struggle.
Behavior-first security architectures are becoming mandatory.
Cyber resilience depends on visibility rather than assumptions.
The lesson is clear: trusted software is no longer synonymous with trusted behavior.
✅ Fact: CERT-UA attributed the activity to the UAC-0099 threat cluster, which has historical links to providing initial access for operations associated with Sandworm/APT44.
✅ Fact: The attackers did not compromise the official Notepad++ project or exploit a confirmed zero-day vulnerability. They abused the application’s normal plugin-loading functionality by packaging legitimate software with malicious files.
✅ Fact: CERT-UA recommended updating Notepad++, 7-Zip, and WinRAR to newer versions as part of broader defensive hygiene, while the Notepad++ developers disputed that CVE-2025-56383 represents a true vulnerability, arguing that plugin loading is intended behavior.
Prediction
(+1) Defensive technologies will increasingly evolve toward behavioral detection rather than signature-based protection, enabling security platforms to identify malicious plugin loading, suspicious scheduled task creation, and abnormal execution chains even when attackers rely entirely on legitimate software. At the same time, software developers are likely to strengthen plugin verification mechanisms, code-signing requirements, and enterprise security controls, making future campaigns of this type significantly harder to execute successfully.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.pinterest.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
