The use of legitimate software to mask malicious activity is a staple of modern cyber warfare, but the recent campaign by threat cluster UAC-0099 demonstrates a sophisticated evolution in stealth. Instead of relying on complex zero-day exploits, the attackers are leveraging Notepad++ to deliver malware, exploiting the inherent trust developers and IT admins place in this ubiquitous text editor.

The Infection Chain: From Phishing to Sideloading

The attack typically begins with phishing emails containing deceptive images or PDF-disguised VBS scripts. Once executed, the script downloads a ZIP archive containing a legitimate copy of Notepad++ version 8.8.3. The trap is sprung via a malicious DLL named NppExport.dll, which the application loads through its standard plugin mechanism.

This DLL, identified as LunchPoke, establishes persistence by creating scheduled tasks and extracting password-protected archives. This leads to the deployment of BurnyBear, a loader for the MatchBoil V2 malware. Notably, BurnyBear includes a fallback mechanism: if the primary execution fails, it triggers a resource exhaustion attack on the host's RAM and CPU to mask its activities while updating C2 configurations.

The Plugin Security Debate

The campaign has sparked a technical dispute over CVE-2025-56383. While CERT-UA researchers flagged a DLL hijacking flaw in version 8.8.3, the Notepad++ development team has disputed this, arguing that plugin loading is a standard feature rather than a vulnerability. This distinction highlights the growing risk of "living-off-the-land" attacks, where legitimate features are weaponized against the user.

Mitigation and Defense

To mitigate this risk, system administrators are urged to update Notepad++ to version 8.9.7 (codenamed "Slava Ukraini"), which addresses several high-impact flaws related to session handling and ZIP extraction. Additionally, updating 7-Zip to 26.02 and WinRAR to 7.23 is critical, as these tools are often used by the attackers to unpack payloads.

This trend of weaponizing trusted productivity tools mirrors other recent threats, such as the exploitation of browser extensions to steal sensitive data, proving that the developer's toolkit is now a primary vector for advanced persistent threats.