Ukraine warns of hackers hiding malware inside a fake Notepad++ plugin

Key points

• Ukraine's national cyber agency CERT-UA says a hacking crew known as UAC-0099 is bundling the real Notepad++ text editor with a booby-trapped plugin to sneak malware onto Windows machines.
• The group has previously been linked to APT44, better known as Sandworm, a unit tied to Russia's military intelligence.
• Victims are lured with a ZIP file containing a script disguised as a PDF, which then downloads a second archive called Evernote.zip.
• The malicious plugin, named LunchPoke, sets up scheduled tasks and unpacks further malware including a loader called BurnyBear and a second-stage tool called MatchBoil V2.
• CERT-UA advises admins to update Notepad++ to 8.9.7, 7-Zip to 26.02 and WinRAR to 7.23.

Ukraine's Computer Emergency Response Team, CERT-UA, has flagged a fresh wave of attacks that hide malicious code inside a completely genuine copy of the popular text editor Notepad++.

The crew behind it is tracked as UAC-0099. It mainly hits Ukrainian organisations, and CERT-UA has previously said it acts as a door-opener for APT44, the group most people know as Sandworm, a hacking unit linked to Russian military intelligence. On 19 July we reported that the same sub-group was planting data-stealing malware through fake CAPTCHA prompts, so this plugin gambit is a deliberate change of delivery method rather than an isolated incident.

This isn't a supply-chain attack. Notepad++ itself hasn't been tampered with. The trick sits entirely in a file dressed up as an ordinary plugin.

How does the attack actually work?

Victims receive a ZIP archive containing a VBS script, a small Windows automation file, disguised as a PDF document. Opening it quietly pulls down a second archive called Evernote.zip.

Inside that archive: a full copy of Notepad++ version 8.8.3, a file called NppExport.dll, a password-protected archive named updater.rar, and a legitimate copy of the WinRAR compression tool.

The script drops everything into a randomly named folder and launches Notepad++. Because that's how Notepad++ normally handles plugins, the editor loads NppExport.dll on its own.

NppExport.dll is LunchPoke, the actual malware. It creates a scheduled task so it survives reboots, then unpacks updater.rar to release two more files: RemoteLibUpdater.exe and InitTest.dll.

RemoteLibUpdater.exe is a loader nicknamed BurnyBear. Its job is to run InitTest.dll, which is itself another loader called MatchBoil V2. MatchBoil V2 then creates a further scheduled task, updates its command-and-control address, and uses WinRAR to unpack whatever it downloads next. If BurnyBear can't start cleanly, it falls back to hammering the machine's memory and processor until it grinds to a halt.

CERT-UA hasn't said what final payload the chain delivers, what the campaign is trying to steal, or which organisations were hit.

Is there a Notepad++ flaw to worry about?

Not really. Researchers point to CVE-2025-56383, described as a DLL hijacking issue in Notepad++ 8.8.3, the same version used in these attacks. The Notepad++ developers have pushed back, saying loading a plugin from the plugin folder is exactly what the program is meant to do. We covered a separate set of Notepad++ code-execution vulnerabilities on 30 May, so the version pinning here looks deliberate rather than coincidental.

The attackers aren't breaking Notepad++. They're asking it to do its normal job with a file they control.

What should organisations do?

CERT-UA's advice is practical and short. Update Notepad++, 7-Zip and WinRAR so attackers can't lean on older bugs in any of those tools as part of a chain like this one.

Staff should be wary of ZIP files arriving by email or chat that claim to contain a PDF. If double-clicking a "PDF" opens something that flashes a black window or asks Windows for permission, that's not a document. Close it and tell IT.

For ordinary readers, this campaign appears aimed squarely at Ukrainian organisations, so there's nothing here targeting personal accounts or banking. The pattern is still worth filing away: a real, trusted program used as cover for a malicious plugin is a technique that travels.