A stealthy new campaign in which the UAC-0099 threat cluster hijacks a legitimate Notepad++ plugin to quietly plant malware on victim machines, marking a significant evolution in the group’s tactics since mid-summer 2026.
Uncovered by Ukraine’s CERT-UA, the infection begins with a phishing email carrying an image that links, via a URL-shortening service, to a file-sharing platform hosting a ZIP archive such as “Attachments to розпорядження.zip” .
Inside sits a double-extension VBS script disguised as a PDF, often padded with extra spaces before the real “.vbs” extension to trick careless readers.
Hackers Abuse Notepad++ Plugins
Once launched, the script fetches a decoy document plus an “Evernote.zip” package containing a full copy of Notepad++ 8.8.3 and a trojanized plugin folder.
The real danger hides inside “/plugins/NppExport/”, where a rogue library named “NppExport.dll” replaces the genuine plugin file. The VBS script creates a randomized directory under %PUBLIC%, unpacks the archive, and executes notepad++.exe, which automatically loads the tampered DLL the moment the editor starts, giving attackers silent code execution without triggering typical security alerts.
This abuse of Notepad++’s plugin-loading behavior echoes the previously disclosed CVE-2025-56383 DLL-hijacking issue affecting version 8.8.3, though CERT-UA notes the Notepad++ team disputes the CVE, calling it standard plugin architecture rather than a flaw.
The malicious “NppExport.dll” is tracked as LUNCHPOKE, a tool that builds a hidden Libraries folder, extracts a password-protected “updater.rar” containing “RemoteLibUpdater.exe” and “InitTest.dll,” then copies Windows’ own schtasks.exe to disguise persistence setup.
It registers a scheduled task under a randomized name to relaunch RemoteLibUpdater.exe every three minutes with the arguments “setup nodisplay.”
RemoteLibUpdater.exe is classified as BURNYBEAR, whose job is loading InitTest.dll. Interestingly, if BURNYBEAR runs without its expected arguments, it switches to a resource-exhaustion routine that deliberately hogs RAM and CPU possibly a built-in anti-analysis or decoy mechanism.
InitTest.dll turns out to be an upgraded MATCHBOIL.V2 loader, previously seen in earlier UAC-0099 campaigns alongside malware like MATCHWOK and DRAGSTARE.
The new version retains its core functions scheduled-task persistence, configuration updates including command-and-control addresses, and downloading additional payloads but now also leverages WinRAR to unpack downloaded components, pulling the utility from Dropbox if it isn’t already installed on the target system.
Takeaway for Defenders
| Component | Role |
|---|---|
| LUNCHPOKE (NppExport.dll) | Trojanized plugin, initial payload dropper |
| BURNYBEAR (RemoteLibUpdater.exe) | Loader for MATCHBOIL, resource-exhaustion fallback |
| MATCHBOIL.V2 (InitTest.dll) | Persistence, C2 config updates, secondary payload delivery |
CERT-UA is urging administrators to keep common software patched, since threat clusters routinely exploit outdated installations for initial compromise. As of July 21, 2026, current secure versions include WinRAR 7.23, 7-Zip 26.02, and Notepad++ 8.9.7, all worth verifying immediately across enterprise fleets.
Organizations should treat unsolicited ZIP attachments referencing government or municipal correspondence with heightened suspicion, monitor for unauthorized DLLs in application plugin directories, and flag scheduled tasks with randomized or unusual naming patterns as potential indicators of this ongoing UAC-0099 campaign.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
