Ukraine’s Computer Emergency Response Team has issued an alert about a sophisticated campaign leveraging a fake Notepad++ plugin to compromise Windows systems. CERT-UA attributes the activity to UAC-0099, a Russia-aligned threat cluster active since at least mid-2022 that has previously weaponized WinRAR vulnerabilities to distribute LONEPAGE malware.
How Does the Attack Chain Unfold?
The campaign, observed earlier this summer, initiates with phishing emails containing image attachments. When victims click the image, they’re redirected to a URL concealed behind a link shortener, which then routes them to file-sharing services like EasySend[.]co to download a ZIP archive. This archive contains a Visual Basic Script masquerading as a PDF document.
Executing the VBScript triggers a decoy PDF to display while silently downloading a second archive named “Evernote.zip.” This secondary archive includes a legitimate copy of Notepad++ version 8.8.3, a malicious DLL plugin called “NppExport.dll,” a password-protected archive “updater.rar,” and a legitimate WinRAR executable.
What Malware Components Are Deployed?
The VBScript extracts the archive contents and launches Notepad++, which loads the malicious “NppExport.dll” component codenamed LUNCHPOKE. This DLL unpacks the RAR archive containing “RemoteLibUpdater.exe” and “InitTest.dll,” establishing persistence through a scheduled task that executes “RemoteLibUpdater.exe” every three minutes.
The “RemoteLibUpdater.exe” binary, identified as BURNYBEAR, functions as a loader for “InitTest.dll,” which represents a modified version of MATCHBOIL designated as MATCHBOIL.V2. This C#-based loader can deliver secondary payloads. CERT-UA noted that if “RemoteLibUpdater.exe” launches without proper arguments, BURNYBEAR activates logic designed to exhaust computer resources by consuming RAM and processor capacity.
What Other Russian Campaigns Are Active?
The disclosure coincides with U.S. government warnings about Laundry Bear (also tracked as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025. This campaign employs a “half-click” exploit abusing CVE-2025-66376 to deploy JavaScript malware called ZimReaper for harvesting email communications and sensitive data.
Proofpoint has also reported on Russian threat actor TA458’s Operation RoundPress, which targets multiple webmail platforms including Kerio, SOGo, Zimbra, mDaemon, and Roundcube using half-click cross-site scripting exploits. In March 2026, the group exploited zero-day vulnerabilities in Kerio and SOGo webmail (CVE-2026-8496), later patched in version 5.12.8. TA458 primarily targets Ukrainian government and Eastern European military entities across Albania, Greece, Moldova, and Türkiye, occasionally targeting chemical, telecommunications, and technology firms.
CERT-UA recommends organizations update their WinRAR, 7-Zip, and Notepad++ software to the latest versions to prevent exploitation of known vulnerabilities in follow-on attacks.
Source: The Hacker News