Back to all lessons
Awareness Lessons
2 days ago

Fake Notepad++ Plugin Used to Deploy Espionage Malware in Phishing Campaign

UAC-0099, a Russia-aligned threat actor, is exploiting user trust in legitimate software by delivering a malicious Notepad++ plugin bundled with a real application installation to avoid suspicion. The attack relies on phishing emails and DLL-based malware delivery, highlighting how supply chain trust and plugin ecosystems can be weaponized against unsuspecting users. Because the malicious DLL is loaded alongside a legitimate tool, traditional signature-based defenses may fail to flag it. This matters because espionage-focused campaigns like this target sensitive organizational data, and the use of trusted application contexts makes detection and user recognition of the threat significantly harder.

Tactical Insight

Immediate actions

  • Block execution of unsigned or unverified DLL files and plugins using application whitelisting tools such as AppLocker or Windows Defender Application Control.
  • Conduct emergency phishing awareness training focused on malicious attachments and fake software bundles targeting employees.
  • Audit all installed Notepad++ plugins across endpoints and remove any that are not officially sanctioned.

Long-term improvements

  • Establish a vetted, organization-approved software and plugin catalog, restricting installation to verified sources only.
  • Implement a formal third-party and plugin supply chain review process before any software component is permitted in the environment.
  • Enforce least-privilege policies to prevent standard users from installing plugins or running VBScript without administrative approval.

Detection measures

  • Deploy endpoint detection and response (EDR) solutions configured to alert on suspicious DLL sideloading and VBScript execution patterns.
  • Enable centralized logging of process creation events, DLL loads, and email attachment activity to support rapid threat hunting.
  • Subscribe to CERT-UA and relevant threat intelligence feeds to receive timely indicators of compromise associated with UAC-0099 campaigns.