They Shipped You a Real Notepad++. The Plugin Was the Malware.
- Patrick Duggan
- 20 minutes ago
- 4 min read
CERT-UA published details this week on a UAC-0099 campaign that does something worth understanding even if you will never be targeted by it.
The victim receives a ZIP. Inside is a VBS script wearing a PDF icon. Running it fetches a second archive, Evernote.zip, and that archive contains a complete, genuine, unmodified copy of Notepad++ 8.8.3.
Not a trojanized build. Not a fake installer. The real editor, which will pass any hash check you throw at it, because it is the real editor.
Alongside it sits a file called NppExport.dll — the name of a legitimate Notepad++ plugin — plus a password-protected updater.rar and a legitimate copy of WinRAR.
The chain
The VBS script drops the whole package into a randomly named directory and launches Notepad++. Notepad++ then does what it has always done and loads the plugins in its plugin directory. One of them is not a plugin.
NppExport.dll is LunchPoke. It creates a Windows scheduled task and uses the bundled legitimate WinRAR to extract the password-protected archive, yielding RemoteLibUpdater.exe and InitTest.dll. The executable is a loader called BurnyBear. The DLL it loads is MATCHBOIL v2.
The scheduled task runs RemoteLibUpdater.exe every three minutes, so persistence survives closing the editor and rebooting the machine.
UAC-0099 primarily targets Ukrainian organizations and has previously been linked to providing initial access for APT44, better known as Sandworm. That is the group that took down power in Ukraine, and the reason a fake text editor plugin deserves your attention.
Why the legitimate binary is the point
Every component in this chain that a defender would naturally inspect is genuinely benign. Notepad++ 8.8.3 is signed and authentic. WinRAR is signed and authentic. The malicious code is one DLL, sitting in a directory where DLLs are supposed to sit, loaded by a mechanism that exists specifically to load DLLs from that directory.
This is not DLL sideloading in the usual sense, where an attacker abuses a search-order quirk. Notepad++ is not being tricked. Its plugin architecture is working exactly as documented. The application was asked to load a plugin and it loaded the plugin.
Which is the pattern we have been circling all year in the package ecosystems — the ChocoPoC work, the poisoned-dependency hunting, the reputation primitive we built for check-package. In all of those cases the shape is identical: the host is clean, the extension is dirty, and every trust signal attached to the host transfers to the extension for free.
Every extensible application carries this. Notepad++ plugins. VS Code extensions. Browser extensions, which we wrote about in April. Jenkins plugins. Obsidian community plugins. Home Assistant integrations. IDE plugin marketplaces. In each case the security model is "the user chose to install it," and in each case the user did not choose — a script did, in a randomly named folder, three seconds after they double-clicked something shaped like a PDF.
What we had
Nothing. CERT-UA has not released a public network indicator set for this campaign at time of writing, and the file names alone — NppExport.dll, RemoteLibUpdater.exe, InitTest.dll, updater.rar — are not blockable indicators. NppExport.dll in particular is the name of a real plugin that ships legitimately.
We are not going to manufacture a receipt here. We did not have this and there is currently very little in it that a blocklist can hold. What it offers is a detection idea, which is worth more than an indicator anyway because it does not expire.
The hunt to run this week
Notepad++ running from a path that is not Program Files. A portable copy in a randomly named directory under a user profile or temp folder is the tell. Legitimate portable use exists, but it is rare enough in a managed environment to be worth reviewing every instance.
Scheduled tasks with three-minute intervals. Almost nothing legitimate needs to run every three minutes. Enumerate scheduled tasks across your fleet, sort by interval, and look at everything under five minutes. This is a ten-minute query that finds a surprising amount.
WinRAR extracting a password-protected archive from a script context. Legitimate WinRAR, invoked by something that is not a human, against an encrypted archive, is a strong signal on its own.
Plugin directories as a monitored surface. For every extensible application in your environment, know where its plugins load from and alert on writes there. Most organizations monitor Program Files and startup folders and have never thought about a plugin directory.
VBS with a PDF icon. Still working in 2026. Enable file extension display by policy. It costs nothing and it has been the right answer for twenty years.
We are 95 percent confident the plugin-directory-as-persistence pattern shows up in a non-Ukrainian criminal campaign within the year, because it is cheap, it defeats hash-based inspection of the host application, and it is now publicly documented. The five percent is that it stays a targeted-espionage technique because commodity crews have easier options that still work.
Credit to CERT-UA for the analysis.
Free IP, domain, hash, and malicious-package blocklists at analytics.dugganusa.com.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments