Summary
- The package contained a legitimate portable Notepad++ build alongside a malicious plugin and additional malware.
- Normal plugin loading was abused to establish persistence and deploy MATCHBOIL.V2.
- Software provenance and application control need to cover plugins, libraries, and portable executables as well as the main binary.
A threat group targeting Ukrainian organisations has packaged a legitimate copy of Notepad++ with a malicious plugin, using the trusted application’s normal loading behaviour to execute malware.
Ukraine’s Computer Emergency Response Team has attributed the campaign to UAC-0099. The delivery chain begins with a Visual Basic script disguised as a PDF document, which retrieves an archive containing the portable Notepad++ 8.8.3 application, a malicious plugin named NppExport.dll, a password-protected archive, and a legitimate copy of WinRAR.
After extraction, Notepad++ launches from a randomly named directory and loads the malicious dynamic-link library as a plugin. That component, identified as LUNCHPOKE, creates persistence through a scheduled task before extracting a loader known as BURNYBEAR and an updated MATCHBOIL.V2 implant.
The available evidence does not indicate that Notepad++’s source code, official website, update mechanism, or authorised installation package was compromised. The attackers assembled their own bundle around legitimate software and relied on the application’s extension system to make the malicious component less conspicuous.
A compromised vendor update can expose every organisation receiving the affected release, while an attacker-created package points towards phishing, download provenance, endpoint execution policy, and the systems or people that received the unauthorised bundle. Both routes place trusted code on an endpoint, but the investigation and containment requirements differ.
Portable applications create a particular control problem because they can run without a conventional installation process and may be placed in user-writable directories. Policies that permit a familiar executable by filename, product description, or vendor signature can miss untrusted components loaded from the same folder.
A legitimate executable does not establish that every library or plugin beside it is legitimate. Application-control rules need to consider execution location, parent process, plugin path, and the relationship between a signed application and unsigned extensions. Monitoring can also identify unexpected scheduled tasks, archive extraction into temporary directories, and trusted utilities loading modules from unusual locations.
Software provenance must extend beyond checking whether the central executable carries a valid signature. Organisations need approved package sources, verification covering the entire distribution, and controls that prevent portable copies obtained through email or third-party download sites from running without review.
Plugin governance often receives less attention than the application itself, even though extensions execute within the trust and process context of the host program. An approved application can therefore become the entry point for unapproved code unless plugins are inventoried, restricted, and monitored.
CERT-UA has recommended updating the software involved in the observed chain, including Notepad++, 7-Zip, and WinRAR, while the campaign’s final objectives and victim scope remain under investigation. Those updates sit alongside the immediate need to block the identified artefacts and determine whether UAC-0099 established persistent access.
The package relies on recognition: users and controls see a widely used utility, while the attacker controls the surrounding files. Provenance, directory context, and extension behaviour carry as much evidential weight as the reputation of the main executable.
