Ukrainian government cybersecurity experts have identified a new campaign by the threat group UAC-0099, which is leveraging legitimate Notepad++ functionality to deploy malware. The attacks, observed by Ukraine's Computer Emergency Response Team (CERT-UA), involve distributing a malicious package disguised as a PDF document that ultimately installs the Notepad++ application alongside a custom malicious plugin.
UAC-0099, a cluster known for targeting Ukrainian organizations and previously linked to providing initial access for the Sandworm APT44 group, has reportedly shifted its tactics. The current method begins with a VBS script masquerading as a PDF, which, when executed, retrieves a second archive named `Evernote.zip`.
This second archive contains a full, legitimate copy of Notepad++ version 8.8.3, a malicious DLL named `NppExport.dll`, a password-protected RAR archive called `updater.rar`, and the legitimate WinRAR executable. The VBS script installs these components into a randomly named directory, launches Notepad++, and then loads `NppExport.dll` through Notepad++'s standard plugin-loading mechanism.
CERT-UA identified `NppExport.dll` as `LunchPoke`, a utility designed to establish persistence by creating a scheduled task on Windows. `LunchPoke` then extracts the contents of `updater.rar`, which includes `RemoteLibUpdater.exe` and `InitTest.dll`. `RemoteLibUpdater.exe` is described as `BurnyBear`, a loader for `InitTest.dll`, which is identified as the `MatchBoil V2` malware loader.
The `BurnyBear` loader also incorporates a fallback mechanism. Should `RemoteLibUpdater.exe` fail to launch, it triggers a resource exhaustion attack targeting the host's RAM and CPU. This fallback also creates another scheduled task, updates its configuration and command-and-control (C2) address, and uses WinRAR to extract additional downloaded programs.
While CERT-UA did not specify the final payloads or the ultimate objectives of this particular campaign, they noted that the attacks do not exploit a vulnerability or supply-chain compromise within Notepad++ itself. Instead, they abuse the application's normal plugin-loading functionality.
The researchers mentioned a DLL hijacking flaw, CVE-2025-56383, affecting Notepad++ v8.8.3, the exact version used in these attacks. However, the Notepad++ development team has reportedly disputed this classification, asserting that plugin loading is an intended and standard feature of the software.
To mitigate potential risks from similar attacks and other known vulnerabilities, CERT-UA recommends that system administrators update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23.
