Fake Notepad++ plugin drops a Windows loader that slips past sandboxes and app allowlists

A genuine, working copy of Notepad++ is doing the dirty work in a campaign that Ukraine's national computer emergency team, CERT-UA, disclosed this week. The real editor is the bait. The malicious code rides in a plugin file loaded beside it and in a follow-on loader that only detonates when it is called with the right arguments. That design defeats two defenses at once: application allowlists that trust software by name or signer, and automated sandboxes that run a sample and watch what it does. Neither sees the attack, because the thing they inspect is legitimate and the thing that is malicious refuses to run for them.

CERT-UA attributes the activity to UAC-0099, a Russia-aligned cluster it has tracked since mid-2022, in advisory 6318634, as Security Affairs reported. The targets are Ukrainian organizations. The interesting part for everyone else is the delivery pattern, which is portable to any Windows estate.

What CERT-UA described

The chain starts with a phishing email carrying an image attachment, as The Hacker News reported. The image conceals a shortened link that resolves to a file-sharing service, which serves a ZIP holding a Visual Basic script dressed up as a PDF. When the victim opens it, the script shows a decoy PDF while quietly pulling down a second archive named Evernote.zip in the background. The lure lands the way many loader campaigns do, a rigged attachment that chains into a second stage, the same shape we broke down when a phishing invoice chained into a remote-management backdoor.

That archive is the clever part. It contains a legitimate Notepad++ 8.8.3, a malicious plugin named NppExport.dll that CERT-UA codenames LUNCHPOKE, a password-protected archive, and a copy of the WinRAR command-line tool. Notepad++ loads the rogue plugin, which uses the bundled WinRAR to expand the encrypted archive. Out of that come RemoteLibUpdater.exe, a loader CERT-UA calls BURNYBEAR, and InitTest.dll, the MATCHBOIL.V2 payload. A scheduled task relaunches the loader every three minutes for persistence.

Why a real Notepad++ is the whole point

Bundling a genuine, signed editor is not laziness. It turns application allowlisting against the defender. A policy that trusts notepad++.exe by file name or by its publisher signature waves the real binary straight through, and the real binary is the one that loads the unsigned NppExport.dll sitting next to it. The malicious decision has already happened by the time anyone inspects a running executable, because the executable is exactly what the vendor ships.

This is DLL sideloading, and the lesson is where you put the trust check. Trusting the process by name or signer is not enough when the process is a legitimate host for someone else's plugin. It is the same trust inversion behind the abuse of a trusted signed driver to switch off defenses: a valid signature on the outer object says nothing about what it is asked to load. The check that catches this is DLL provenance: is the module that just loaded signed, and does it live where the vendor actually ships it, or did it appear in a user-writable folder alongside a portable copy of an app. Notepad++ itself is not compromised here, and neither is its developer. A clean copy is being used as a carrier, which is a different problem than a vulnerability in the software.

The self-sabotage is an anti-sandbox trick

The loader has an unusual quirk. CERT-UA reports that if RemoteLibUpdater.exe is launched without the correct arguments, it does not sit quietly. It runs logic that exhausts the machine's memory and processor instead.

Read as anti-analysis, this is sharper than it first looks. It inverts the way most automated sandboxes triage a file. A sandbox typically executes an unknown sample on its own, with no arguments, and scores what happens. Do that here and you get a resource hog that looks like broken or miner-like junk, not a staged loader, so the sample can be misclassified and set aside. The real behavior only fires when the loader is called correctly, which happens through the scheduled task the installer creates. That flips the highest-value artifact from the detonation to the task definition, because the arguments the loader needs are written into the scheduled task, not discoverable by running the binary blind.

Every evasion here is paid for in noise

The stealth is real, but it is not free. Each trick this campaign uses to hide from static and sandbox inspection buys a loud, repetitive footprint on the host itself. A scheduled task that relaunches a binary every three minutes is rare in benign software. A bundled archiver expanding a password-protected archive under a user profile, moments after a mail or browser download, is rare. A portable editor loading an unsigned plugin from a user-writable directory is rare. Individually each is a weak signal. Together, in that order, they are close to a signature.

That asymmetry is the defender's opening, and it favors behavioral detection over file scanning. Concrete things to watch for:

• A signed, portable application loading an unsigned DLL from a user-writable path. Sysmon image-load events or EDR module-load telemetry surface this.

• Scheduled tasks that relaunch an executable from a user profile directory at a short, fixed interval. The three-minute cadence here is a gift.

• A bundled copy of WinRAR or another archiver expanding a password-protected archive shortly after a download, under a user context rather than an installer.

• On the mail side, image attachments that resolve to link-shortened file-sharing URLs.

CERT-UA published indicators with advisory 6318634. Pull the file names, hashes, and infrastructure into your detections rather than treating any single string as the whole story, because the file names in particular are the part this group changes most.

This is toolchain iteration, not a new threat

It is tempting to file this as a fresh piece of malware, chase the new file names, and move on. That reads the story at the wrong altitude. UAC-0099 is the same operator with the same goal it had in 2022, wearing a new wrapper. Its through-line is abusing trusted tools as carriers: the group has previously weaponized WinRAR flaws and leaned on families like LONEPAGE, MATCHBOIL, and DRAGSTARE, and it is now nesting its loader inside a bundled editor. The wrapper changed. The play did not.

So model the actor, not the artifact. A defense tuned to the pattern, legitimate tool as carrier, sideloaded module, short-interval persistence, keeps working when the next campaign swaps Notepad++ for some other portable app and renames every file. A defense tuned to NppExport.dll and a three-minute task expires the moment this group ships its next build. The same trusted-tool-abuse logic runs through other recent detection work, from trojanized developer tooling that delivered a stealer to a shared delivery technique you can detect once and catch broadly, and it is the durable thing to internalize here.