Hackers abuse Notepad++ plugins to stealthily install malware

Summary

Ukraine's CERT has identified a campaign by threat cluster UAC-0099, linked to APT44 (Sandworm), that distributes a ZIP archive containing the legitimate Notepad++ application and a malicious plugin named LunchPoke. This plugin establishes persistence by creating scheduled tasks and loading further malware, including the MatchBoil V2 loader, potentially exploiting a DLL hijacking flaw in Notepad++ v8.8.3.

Full text

Hackers abuse Notepad++ plugins to stealthily install malware By Bill Toulas July 23, 2026 12:32 PM 0 Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence. The campaign has been attributed to a threat cluster tracked as UAC-0099, which primarily targets organizations in Ukraine and has previously been linked to providing initial access for attacks carried out by APT44, also known as Sandworm. The attackers do not exploit any vulnerability or a supply-chain compromise impacting the popular software. Notepad++ attack chain CERT-UA observed that UAC-0099 changed their modus operandi recently and now delivers a ZIP archive with a VBS script disguised as a PDF document. When launched, the PDF retrieves another compressed file named Evernote.zip. The second archive contains a complete copy of the legitimate editor Notepad++ version 8.8.3, a malicious plugin (NppExport.dll), a password-protected archive (updater.rar), and the legitimate WinRAR executable. Overview of the UAC-0099 attackSource: CERT-UA The VBS script installs the package into a randomly named directory, launches Notepad++, and then loads the malicious NppExport.dll via the application’s normal plugin-loading mechanism. CERT-UA explains that this DLL is LunchPoke, a tool that creates a scheduled task on Windows and extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll. The executable in the RAR file is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader. MatchBoid v2 codeSource: CERT-UA BurnyBear also features a fallback mechanism in case launching RemoteLibUpdater.exe fails, triggering a resource exhaustion attack targeting the host’s RAM and CPU. The latter creates another scheduled task, updates its configuration and command-and-control (C2) address, and then uses WinRAR to extract downloaded programs. CERT-UA does not mention the final payloads delivered in the observed attacks, the purpose of the campaign, or the targeted organizations. The researchers mention CVE-2025-56383, a DLL hijacking flaw in Notepad++ v8.8.3, the exact version used in these attacks, but note that the Notepad++ team has disputed this issue, claiming that plugin loading is standard functionality. CERT-UA advises system administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23, to prevent hackers from exploiting known flaws in existing products and enabling stealthy attacks. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Critical wp2shell WordPress flaws exploited to install webshellsAustralia warns of global campaign targeting vulnerable CMS platformsUkraine's army targeted in new charity-themed malware campaignShapedPlugin update flow hacked to infect WordPress sitesHackers exploit info disclosure bug in Gravity SMTP WordPress plugin

Indicators of Compromise

• malware — LunchPoke
• malware — MatchBoil V2
• malware — BurnyBear
• cve — CVE-2025-56383

Entities