Notepad++ Plugin Attack Delivers Malware to Ukrainian Organisations

A Notepad++ plugin attack has targeted organisations in Ukraine with a malicious utility disguised as a legitimate plugin. The campaign bundles a real copy of the text editor with malware designed to establish persistence on Windows devices.

Ukraine’s national cyber defence team, CERT-UA, linked the activity to UAC-0099, a threat cluster that has previously provided initial access for attacks associated with APT44, also known as Sandworm.

Fake PDF launches malicious Notepad++ package

The attackers recently changed their delivery method. They now send victims a ZIP archive containing a VBS script disguised as a PDF document.

When a user opens the file, the script downloads another archive named Evernote.zip. That archive contains a complete copy of Notepad++ version 8.8.3, along with a malicious plugin called NppExport.dll.

It also includes a password-protected RAR archive, updater.rar, and a legitimate WinRAR executable.

The script installs the files in a randomly named directory, launches Notepad++, and loads NppExport.dll through the application’s normal plugin-loading mechanism.

Malicious plugin creates scheduled tasks

CERT-UA identified NppExport.dll as LunchPoke, a tool that creates a scheduled task to maintain access on the compromised device.

LunchPoke extracts files from updater.rar, including RemoteLibUpdater.exe and InitTest.dll. The executable acts as a loader for the DLL, which researchers linked to the MatchBoil V2 malware loader.

If RemoteLibUpdater.exe fails to start, BurnyBear can trigger a resource-exhaustion attack against the victim’s device. This fallback consumes RAM and CPU resources.

The malware then creates another scheduled task, updates its configuration and command-and-control server address, and uses WinRAR to unpack additional downloaded programs.

CERT-UA did not identify the final payloads, the exact targets, or the campaign’s ultimate objective.

Attack does not exploit Notepad++ vulnerability

The Notepad++ plugin attack does not involve a confirmed supply-chain compromise or an exploit in the editor itself. Instead, it abuses the software’s standard plugin-loading feature to make the malicious DLL appear legitimate.

Researchers mentioned CVE-2025-56383, a reported DLL hijacking issue affecting Notepad++ 8.8.3, the version used in the campaign. However, the Notepad++ developers have disputed that the behaviour represents a vulnerability, stating that plugin loading works as intended.

CERT-UA recommends that administrators update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23. Keeping these tools current can reduce exposure to known flaws that attackers may use alongside social-engineering attacks.