A recent cyber threat has emerged where hackers exploit Notepad++ plugins to infiltrate systems undetected. Identified as UAC-0099, this group has significantly advanced their tactics since mid-2026, targeting users through seemingly legitimate software.
Phishing Campaign Initiates Attack
The campaign begins with a phishing email uncovered by Ukraine’s CERT-UA. The email includes an image linking to a file-sharing service through a URL shortener, which hosts a ZIP archive named ‘Attachments to розпорядження.zip’. This archive conceals a VBS script disguised as a PDF, intended to deceive users into execution.
The script, once activated, downloads a decoy document alongside ‘Evernote.zip’, containing Notepad++ 8.8.3 and a compromised plugin folder. This carefully orchestrated setup allows attackers to gain control stealthily.
Exploit Through Notepad++ Plugins
The core of the attack lies in the ‘/plugins/NppExport/’ directory, where a malicious ‘NppExport.dll’ library replaces the legitimate plugin. The script creates a directory under %PUBLIC%, extracts the files, and launches notepad++.exe. This action loads the malicious DLL, enabling silent code execution without triggering security alerts.
This vulnerability exploits Notepad++’s plugin architecture, reminiscent of the CVE-2025-56383 DLL hijacking issue, though the Notepad++ team considers it a standard feature rather than a flaw.
Malware Components and Impact
The rogue ‘NppExport.dll’, known as LUNCHPOKE, sets the stage by creating a hidden Libraries folder and using Windows’ schtasks.exe to establish persistence. It initiates a scheduled task that executes ‘RemoteLibUpdater.exe’, identified as BURNYBEAR, every three minutes.
BURNYBEAR is tasked with loading ‘InitTest.dll’, a MATCHBOIL.V2 loader, which maintains persistence and updates configuration. It leverages WinRAR for unpacking components, fetching it from Dropbox if needed, thus escalating the threat’s complexity.
Defensive Measures and Recommendations
CERT-UA advises organizations to keep all software updated, as older versions are commonly exploited. As of July 21, 2026, secure versions include WinRAR 7.23, 7-Zip 26.02, and Notepad++ 8.9.7. Companies should scrutinize unexpected ZIP attachments and monitor for unauthorized DLLs within plugin directories.
Flagging unusual scheduled tasks can also help identify potential threats. Strengthening security measures and improving threat detection capabilities are crucial steps in mitigating these sophisticated cyber attacks.
