A ZIP archive that opens like a harmless PDF is the entry point: CERT-UA reports UAC-0099 now delivers a VBS script disguised as a PDF which, once run, pulls a second archive that contains a full copy of Notepad++ v8.8.3 alongside a malicious plugin and a password‑protected RAR.
The attack chain CERT‑UA observed
According to Ukraine's Computer Emergency Response Team (CERT‑UA), the campaign begins with a ZIP file containing a VBS script masquerading as a PDF. When the script runs it retrieves a second compressed file named Evernote.zip. That archive holds a complete copy of Notepad++ version 8.8.3, a malicious DLL presented as a plugin (NppExport.dll), a password‑protected archive labelled updater.rar, and the legitimate WinRAR executable.
The VBS installer places the package in a randomly named directory, launches Notepad++, and relies on the editor’s normal plugin‑loading mechanism to load NppExport.dll. CERT‑UA says the DLL is a component called LunchPoke that establishes persistence by creating a scheduled task and extracting the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll.
LunchPoke, BurnyBear, and MatchBoil V2: the component chain
CERT‑UA traces the chain inside the RAR: RemoteLibUpdater.exe is an executable named BurnyBear, described by the researchers as a loader for a DLL that is the MatchBoil V2 malware loader. BurnyBear also includes a fallback behavior: if launching RemoteLibUpdater.exe fails, it triggers a resource exhaustion attack that targets the host’s RAM and CPU.
The malicious tooling, once established, creates additional scheduled tasks, updates its configuration and command‑and‑control (C2) address, and uses WinRAR to extract further downloaded programs. CERT‑UA does not report the final payloads observed in these incidents or state the campaign’s ultimate objectives.
Attribution and the software angle
CERT‑UA attributes the campaign to a threat cluster tracked as UAC‑0099. The advisory notes UAC‑0099 primarily targets organizations in Ukraine and has previously been linked to providing initial access for operations by APT44 (also known as Sandworm). The researchers emphasize the attackers are not exploiting a zero‑day or a supply‑chain compromise of Notepad++; rather, they are abusing the editor’s standard plugin‑loading mechanism to load a malicious DLL bundled alongside a legitimate copy of the application.
CERT‑UA mentions CVE‑2025‑56383, a reported DLL hijacking issue in Notepad++ v8.8.3 — the exact version used in the observed attacks — but notes the Notepad++ team has disputed that characterisation, asserting that plugin loading is standard functionality.
Recommended mitigations and affected software versions
To blunt the techniques seen in these incidents, CERT‑UA advises system administrators to update Notepad++ to version 8.9.7, 7‑Zip to version 26.02, and WinRAR to version 7.23. The guidance is presented as a way to prevent attackers from leveraging known flaws in existing products and to reduce opportunities for stealthy abuse of legitimate utilities bundled with malicious components.
What this means for Ukrainian organizations, security teams, and open‑source maintainers
- Ukrainian organizations: CERT‑UA’s advisory is explicit that attacks by UAC‑0099 are aimed primarily at organizations in Ukraine; those organizations are the immediate focus for the defensive steps and version upgrades CERT‑UA prescribes.
- Security teams: defenders should be alert to installation from user‑run archives and to scheduled tasks created soon after benign applications are launched. The chain leverages normal plugin loading and legitimate tooling (Notepad++ and WinRAR), so telemetry that correlates new scheduled tasks with recent application installs is relevant.
- Open‑source maintainers and vendors: the notice highlights a tension between expected application behavior (plugin loading) and how adversaries can abuse that behavior; CERT‑UA’s reference to CVE‑2025‑56383 and the Notepad++ team’s response underscores that differences in interpretation of functionality can shape both detection and remediation choices.
CERT‑UA’s advisory documents a deliberate shift in tradecraft — delivering a full, legitimate editor alongside a malicious plugin and a second-stage loader — that sidesteps supply‑chain claims and exploits standard application behaviors. The notice leaves open what final payloads UAC‑0099 delivers in these incidents and what the actors’ immediate goals are; in the meantime, the agency’s concrete update recommendations give defenders a clear, actionable step.
Source: BleepingComputer / CERT‑UA advisory (via BleepingComputer)
