Fake Notepad++ Plugin Used to Deploy Espionage Malware in Phishing Campaign
UAC-0099, a Russia-aligned threat actor, is exploiting user trust in legitimate software by delivering a malicious Notepad++ plugin bundled with a real application installation to avoid suspicion. The attack relies on phishing emails and DLL-based malware delivery, highlighting how supply chain trust and plugin ecosystems can be weaponized against unsuspecting users. Because the malicious DLL is loaded alongside a legitimate tool, traditional signature-based defenses may fail to flag it. This matters because espionage-focused campaigns like this target sensitive organizational data, and the use of trusted application contexts makes detection and user recognition of the threat significantly harder.
Tactical Insight
Immediate actions
- Block execution of unsigned or unverified DLL files and plugins using application whitelisting tools such as AppLocker or Windows Defender Application Control.
- Conduct emergency phishing awareness training focused on malicious attachments and fake software bundles targeting employees.
- Audit all installed Notepad++ plugins across endpoints and remove any that are not officially sanctioned.
Long-term improvements
- Establish a vetted, organization-approved software and plugin catalog, restricting installation to verified sources only.
- Implement a formal third-party and plugin supply chain review process before any software component is permitted in the environment.
- Enforce least-privilege policies to prevent standard users from installing plugins or running VBScript without administrative approval.
Detection measures
- Deploy endpoint detection and response (EDR) solutions configured to alert on suspicious DLL sideloading and VBScript execution patterns.
- Enable centralized logging of process creation events, DLL loads, and email attachment activity to support rapid threat hunting.
- Subscribe to CERT-UA and relevant threat intelligence feeds to receive timely indicators of compromise associated with UAC-0099 campaigns.