“At the same time, if 'RemoteLibUpdater.exe' is launched incorrectly, namely without specifying arguments, BURNYBEAR instead activates logic designed to exhaust computer resources (RAM and processor),” CERT-UA warned — a specific failure mode in a multi-stage campaign that also schedules a loader to run every three minutes to maintain persistence.
How the Notepad++ plugin bait delivers MATCHBOIL.V2
CERT-UA describes a summer campaign that begins with a phishing email containing an image attachment. Clicking the image opens a shortened link that points to a file-share host such as EasySend[.]co and retrieves a ZIP archive. That ZIP contains a Visual Basic Script (VBScript) that masquerades as a PDF. When executed, the VBScript downloads and displays a decoy PDF while silently fetching a second archive named "Evernote.zip."
Evernote.zip contains a complete copy of Notepad++ version 8.8.3, a malicious DLL named "NppExport.dll," a password-protected archive "updater.rar," and a legitimate WinRAR executable "winrar.exe." The VBScript extracts the archive and launches Notepad++, which loads "NppExport.dll." CERT-UA gives that malicious DLL the codename LUNCHPOKE: its job is to unpack the RAR archive to a specific directory and create persistence by installing a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
MATCHBOIL.V2, BURNYBEAR, and the secondary payload chain
The unpacked "RemoteLibUpdater.exe" is the binary BURNYBEAR, which acts as a loader for "InitTest.dll." CERT-UA says InitTest.dll is a modified version of MATCHBOIL — a C#-based loader — and the new iteration is codenamed MATCHBOIL.V2. MATCHBOIL.V2 is capable of delivering secondary payloads after the initial compromise.
CERT-UA also notes a built-in failure mode: if RemoteLibUpdater.exe is started without the expected arguments, BURNYBEAR will execute logic aimed at exhausting system RAM and processor resources, a behavior the agency highlighted explicitly in its advisory.
Attribution: UAC-0099 and a pattern of Russian-aligned activity
The agency attributed the campaign to a threat cluster it tracks as UAC-0099, describing it as Russia-aligned and active since at least mid-2022. CERT-UA linked UAC-0099 to previous techniques including weaponizing WinRAR flaws to deliver a malware strain called LONEPAGE, and earlier phishing campaigns that deployed MATCHBOIL, MATCHWOK, and DRAGSTARE.
The advisory situates this disclosure amid several other Russian-linked campaigns publicized in recent years. The U.S. government has disclosed a separate phishing campaign by a group dubbed Laundry Bear (also tracked as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that exploited CVE-2025-66376 to deliver ZimReaper against Zimbra webmail; Proofpoint has detailed TA458’s Operation RoundPress and related SpyPress tooling; and ESET, Proofpoint, and Hunt.io reporting are cited for earlier exposures and related activity.
Software targets, related exploits, and prior incidents
CERT-UA’s advisory highlights how the campaign leverages trusted applications and unpackers — Notepad++ and WinRAR — to hide malicious plugins and loaders. The agency recommended updating WinRAR, 7-Zip, and Notepad++ to the latest versions to close opportunities for follow-on exploitation.
Complementary public reporting describes other webmail-focused operations: the U.S. government called Laundry Bear’s use of a "half-click" exploit in Zimbra a view-based attack that required only that a user view a malicious email in a vulnerable webmail service. Proofpoint documented expansion of similar "half-click" cross-site scripting exploits against Kerio Webmail and SOGo Webmail, Zimbra, mDaemon, and Roundcube, including exploitation of a March 2026 zero-day in Kerio and SOGo (CVE-2026-8496), later patched in SOGo version 5.12.8.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Expect adversaries to continue using legitimate application binaries (Notepad++, WinRAR) and plugin pathways to gain code execution. The campaign’s use of a scheduled task that runs every three minutes underscores the value of monitoring for unexpected task creation and anomalous, high-frequency process launches.
- Procurement and software owners: CERT-UA’s recommendation to update WinRAR, 7-Zip, and Notepad++ reflects a practical mitigation: maintain current builds of tools that adversaries commonly use as living-off-the-land components or as vessels for malicious plugins.
- End users: The chain starts with a seemingly benign image in an email; users should treat unexpected attachments or links cautiously and report suspicious messages to incident handlers.
CERT-UA’s advisory documents a layered operation that mixes social engineering, accepted tooling, and modular loaders — MATCHBOIL.V2 riding on a fabricated Notepad++ plugin — and it sits alongside other disclosures about view-based webmail exploits and long-running Russian-aligned threat campaigns. The practical next step the agency gave is simple and immediate: patch WinRAR, 7-Zip, and Notepad++ and monitor for the particular persistence and loader behaviors the advisory describes.
https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html