Critical Notepad++ Plugin Vulnerability Lets Attackers Compromise Systems

Key Takeaways

• A new campaign by the UAC-0099 threat group is exploiting Notepad++’s plugin loading mechanism.
• The attack chain involves phishing, a malicious VBScript, and a trojanized Notepad++ plugin (NppExport.dll) to achieve silent code execution.
• The campaign deploys a multi-stage malware payload, including LUNCHPOKE, BURNYBEAR, and an updated MATCHBOIL.V2 loader.
• The Notepad++ team disputes the classification of the plugin loading behavior as a vulnerability (CVE-2025-56383), considering it standard architecture.
• Organizations are advised to update common software, exercise caution with unsolicited attachments, and monitor for suspicious DLLs and scheduled tasks.

Notepad++ Plugin Abused in Sophisticated Malware Campaign

A notable shift in tactics by the UAC-0099 threat cluster has been uncovered, revealing a sophisticated campaign that leverages a legitimate Notepad++ plugin to surreptitiously inject malware onto target systems. This marks a significant escalation in the group’s operational methods since mid-2026.

Initial Infection Vector: Deceptive Phishing

Details from Ukraine’s CERT-UA illustrate that the infection sequence typically commences with a phishing email. This email contains an image that, when clicked, redirects the victim through a URL-shortening service to a file-sharing platform. This platform hosts a ZIP archive, often named deceptively, such as “Attachments to розпорядження.zip”.

Within this archive resides a VBS script, cleverly disguised as a PDF document through the use of a double extension. Attackers frequently pad the filename with extra spaces before the authentic “.vbs” extension to mislead users into believing it is a safe PDF file.

Hijacking Notepad++ for Covert Execution

Upon execution, the malicious VBS script performs several critical actions. It first retrieves a benign decoy document, likely to distract the user, alongside an “Evernote.zip” package. This package is the core of the attack, containing a full installation of Notepad++ version 8.8.3 and a compromised plugin directory.

The true danger lies within the “/plugins/NppExport/” folder. Here, a malicious library, “NppExport.dll,” is substituted for the genuine plugin file. The VBS script then creates a randomly named directory under %PUBLIC%, unpacks the archive, and launches notepad++.exe. Crucially, the moment Notepad++ starts, it automatically loads the tampered DLL, enabling attackers to execute arbitrary code silently without triggering typical security alerts.

This method of exploiting Notepad++’s plugin-loading mechanism bears resemblance to a previously disclosed DLL-hijacking vulnerability, CVE-2025-56383, which affected version 8.8.3. However, CERT-UA notes that the Notepad++ development team contests the CVE’s classification, arguing it represents standard plugin architecture rather than a security flaw.

Multi-Stage Malware Deployment: LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2

The malicious “NppExport.dll” is identified as LUNCHPOKE, an initial payload dropper designed to establish a hidden “Libraries” folder. From this location, it extracts a password-protected “updater.rar” archive containing “RemoteLibUpdater.exe” and “InitTest.dll.” To further obscure its activities, LUNCHPOKE copies Windows’ legitimate schtasks.exe utility to facilitate persistence setup.

It then registers a scheduled task under a randomized name, configured to execute “RemoteLibUpdater.exe” every three minutes with the arguments “setup nodisplay.”

The “RemoteLibUpdater.exe” component is classified as BURNYBEAR, whose primary function is to load “InitTest.dll.” Interestingly, if BURNYBEAR is launched without its expected command-line arguments, it triggers a resource-exhaustion routine, intentionally consuming significant RAM and CPU resources. This behavior could serve as an anti-analysis mechanism or a decoy to hinder investigation.

“InitTest.dll” has been identified as an upgraded version of the MATCHBOIL.V2 loader. This loader has been observed in prior UAC-0099 campaigns, often deployed alongside other malware such as MATCHWOK and DRAGSTARE.

The updated MATCHBOIL.V2 retains its core functionalities, including establishing scheduled task persistence, updating command-and-control (C2) addresses, and downloading additional payloads. A new feature in this version is its ability to leverage WinRAR for unpacking downloaded components, even fetching the WinRAR utility from Dropbox if it is not already present on the target system.

What You Should Do

• Update Software: CERT-UA is urging administrators to ensure all common software, including Notepad++, WinRAR, and 7-Zip, is patched to the latest secure versions. As of July 21, 2026, recommended secure versions include WinRAR 7.23, 7-Zip 26.02, and Notepad++ 8.9.7.
• Exercise Caution with Attachments: Treat unsolicited ZIP attachments, especially those purporting to be from government or municipal entities, with extreme suspicion.
• Monitor Plugin Directories: Implement monitoring for unauthorized or suspicious DLL files appearing in application plugin directories, particularly for commonly used software.
• Review Scheduled Tasks: Regularly audit and flag scheduled tasks with randomized or unusual naming conventions, as these can be indicators of compromise by the UAC-0099 campaign.
• Implement Email Security: Enhance email security measures to detect and block phishing attempts, especially those using URL-shortening services or leading to file-sharing platforms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.