Notepad++ Hack Detailed Along With the IoCs and Custom Malware Used

A sophisticated espionage campaign attributed to the Chinese Advanced Persistent Threat (APT) group Lotus Blossom (also known as Billbug).

The threat actors compromised the infrastructure hosting the popular text editor Notepad++ to deliver a custom, previously undocumented backdoor named “Chrysalis”.

This campaign, discovered by Rapid7 researcher Ivan Feigl, primarily targets organizations in the government, telecommunications, aviation, and critical infrastructure sectors across Southeast Asia and Central America.

The investigation began with a security incident stemming from the execution of a malicious file named update[.]exe, which was downloaded from a suspicious IP address (95.179.213[.]0) following the legitimate execution of notepad++[.]exe and GUP[.]exe (the generic updater for Notepad++)

Forensic analysis revealed that update[.]exe is an NSIS installer, a tool frequently abused by Chinese APTs for initial payload delivery.

Upon execution, the installer creates a hidden directory in the %AppData% folder named “Bluetooth” and drops several files, including BluetoothService.exe and log.dll.

The executable BluetoothService.exe is actually a renamed, legitimate Bitdefender Submission Wizard binary. The attackers utilize this legitimate file to perform DLL sideloading, forcing it to load the malicious log.dll instead of the genuine library.

The Chrysalis Backdoor

Once loaded, log.dll decrypts and executes a shellcode payload the Chrysalis backdoor. This malware is a sophisticated, feature-rich implant designed for long-term persistence rather than simple “smash-and-grab” operations, Rapid7 observed.

Chrysalis employs several advanced evasion techniques:

• Custom Encryption: It uses a linear congruential generator for decryption rather than standard cryptographic APIs, making it harder for automated tools to flag.
• API Hashing: The malware resolves necessary Windows APIs using a custom hashing algorithm (FNV-1a combined with a MurmurHash-style finalizer) to evade static analysis and antivirus detection.
• C2 Communication: The backdoor communicates with its Command and Control (C2) server (api.skycloudcenter.com) over HTTPS. Notably, the C2 URL structure mimics the Deepseek API endpoints (e.g., /a/chat/s/{GUID}), likely an attempt to blend in with legitimate AI-related network traffic.

Chrysalis is highly versatile, supporting 16 different commands controlled by a switch statement in the code. Key capabilities include:

• Interactive Shell: Spawning a fully interactive reverse shell via cmd.exe (Switch 4T).
• File Operations: Reading, writing, and deleting files, as well as enumerating directory contents (Switches 4W, 4X, 4Y).
• Process Execution: Launching remote processes (Switch 4V).
• Self-Removal: A “cleanup” mode that removes persistence artifacts and deletes the malware from the disk (Switch 4).

Advanced Loading with Microsoft Warbird

Beyond Chrysalis, researchers discovered a loader variant (ConsoleApplication2.exe) that leverages Microsoft Warbird, a complex code protection framework, to hide its execution flow.

This loader abuses the NtQuerySystemInformation system call with the undocumented SystemCodeFlowTransition (0xB9) class.

By copying encrypted data into the memory of a Microsoft-signed binary (clipc.dll) and invoking this specific system call, the loader triggers the Warbird mechanism to decrypt and execute the shellcode in the kernel context.

This technique effectively bypasses user-mode hooks and standard EDR monitoring, marking a significant evolution in Billbug’s tradecraft.

The campaign is attributed to Lotus Blossom with moderate confidence, based on the specific use of the Bitdefender sideloading technique and shared cryptographic keys found in the Cobalt Strike beacons deployed alongside Chrysalis.

Indicators of Compromise (IoCs)

Here are the Indicators of Compromise (IoCs) and MITRE ATT&CK TTPs associated with the Lotus Blossom campaign and the Chrysalis backdoor.

File Indicators

Network Indicators

MITRE ATT&CK TTPs

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.