Hackers Use Legitimate Notepad++ Installer to Hide Malicious Plugin and Deploy Malware
What Happened — Ukraine’s CERT uncovered a campaign (UAC‑0099) that distributes a ZIP archive containing a genuine Notepad++ 8.8.3 installer together with a malicious DLL masquerading as the NppExport plugin. When the archive is opened, a VBS script (disguised as a PDF) launches Notepad++, loads the malicious plugin, creates scheduled tasks, and ultimately runs the BurnyBear loader to fetch additional payloads. No vulnerability in Notepad++ was required; the attackers rely on trusted‑software execution to stay under the radar.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how a lack of application‑allowlist controls and software‑version governance can let attackers piggy‑back on legitimate binaries – a classic control‑gap scenario SOC 2 expects you to monitor and evidence.
- Highlights the need for continuous control mapping (e.g., linking approved software inventories to change‑management logs) so auditors can see that only vetted versions are in use.
- Provides a real‑world example where audit evidence (hashes of approved installers, DLL‑load logs) can prove due diligence and defend against claims of “uncontrolled software.”
Who Is Affected — Primarily Ukrainian enterprises, but any organization that permits end‑user installation of third‑party tools without strict version control (technology, finance, government, and manufacturing sectors).
Recommended Actions
- Update Notepad++ to 8.9.7 (or later) and enforce a policy that only approved, signed installers may run.
- Deploy an application‑allowlist solution and log all DLL load events for forensic review.
- Incorporate the Notepad++ version check into your continuous compliance dashboard to generate audit‑ready evidence.
Source: BleepingComputer
Technical Notes
- Attack vector: Phishing‑style delivery (VBS script masquerading as PDF) → legitimate installer → malicious plugin (DLL hijack).
- Relevant CVE: CVE‑2025‑56383 (DLL hijacking claim, disputed by Notepad++ team).
- Malware: LunchPoke → scheduled tasks → BurnyBear loader → MatchBoil V2.
- Data types: No explicit data exfiltration reported; the payload chain is designed for persistence and further download of unknown modules.