Ukraine warns of hackers hiding malware inside a fake Notepad++ plugin

Key points

• Ukraine's national cyber agency CERT-UA says a hacking crew known as UAC-0099 is bundling the real Notepad++ text editor with a booby-trapped plugin to sneak malware onto Windows machines.
• The group has previously been linked to APT44, better known as Sandworm, a unit tied to Russia's military intelligence.
• Victims are lured with a ZIP file containing a script disguised as a PDF, which then downloads a second archive called Evernote.zip.
• The malicious plugin, named LunchPoke, sets up scheduled tasks and unpacks further malware including a loader called BurnyBear and a second-stage tool called MatchBoil V2.
• CERT-UA advises admins to update Notepad++ to 8.9.7, 7-Zip to 26.02 and WinRAR to 7.23.

Ukraine's Computer Emergency Response Team, CERT-UA, has flagged a fresh wave of attacks that hide malicious code inside a completely genuine copy of the popular text editor Notepad++.

The crew behind it is tracked as UAC-0099. It mainly hits Ukrainian organisations, and CERT-UA has previously said it acts as a door-opener for APT44, the group most people know as Sandworm, a hacking unit linked to Russian military intelligence.

This is not a supply-chain attack. The version of Notepad++ being shipped to victims is the real thing, downloaded from the real developer. The trick sits next to it, in a file dressed up as an ordinary plugin.

How does the attack actually work?

Victims first receive a ZIP archive containing a VBS script, a small Windows program file, disguised to look like a PDF document. First reported by BleepingComputer, the CERT-UA analysis says opening that fake PDF quietly pulls down a second archive called Evernote.zip.

Inside the second archive sits a full copy of Notepad++ version 8.8.3, a file called NppExport.dll, a password-protected archive named updater.rar, and a legitimate copy of the WinRAR compression tool.

The script drops everything into a folder with a random name and launches Notepad++. The editor then loads NppExport.dll on its own, because that is how Notepad++ normally handles plugins.

The DLL is the malware. CERT-UA calls it LunchPoke. It creates a scheduled task on Windows so it survives reboots, then unpacks the password-protected archive to release two more files: RemoteLibUpdater.exe and InitTest.dll.

RemoteLibUpdater.exe is a loader nicknamed BurnyBear. Its job is to run InitTest.dll, which is itself another loader called MatchBoil V2. If BurnyBear cannot start cleanly, it falls back to a crude tactic: hammering the computer's memory and processor until the machine grinds to a halt.

CERT-UA has not said what final payload the chain delivers, what the campaign is trying to steal, or which organisations were hit.

Is there a Notepad++ flaw to worry about?

Not really. Researchers point to CVE-2025-56383, described as a DLL hijacking issue in Notepad++ 8.8.3, the same version used in these attacks. The Notepad++ developers have pushed back, saying loading a plugin from the plugin folder is exactly what the program is meant to do.

In plain terms: the attackers are not breaking Notepad++. They are asking it to do its normal job with a file they control.

What should organisations do?

CERT-UA's advice is practical and short. Update Notepad++, 7-Zip and WinRAR, so attackers cannot lean on older bugs in any of those tools as part of a chain like this one.

Staff should also be wary of ZIP files arriving by email or chat that claim to contain a PDF. If double-clicking a "PDF" opens something that flashes a black window or asks Windows for permission, that is not a document. Close it and tell IT.

For ordinary readers, there is nothing here that touches your personal accounts or bank. The campaign appears aimed squarely at organisations in Ukraine. Still, the pattern, a real program used as cover for a bad plugin, is one worth remembering the next time a colleague forwards you a helpful-looking bundle of files.