A sophisticated phishing campaign discovered in mid-2026 demonstrates how the UAC-0099 threat cluster is weaponizing the legitimate Notepad++ plugin architecture to silently install malware on victim systems. Ukraine’s CERT-UA uncovered the attack chain, which represents a significant tactical evolution for the group.
The infection begins with a phishing email containing an embedded image that links through a URL-shortening service to a file-sharing platform. Victims download a ZIP archive with names such as “Attachments to розпорядження.zip” that contains a VBS script disguised as a PDF document using a double-extension technique. The attackers pad the filename with extra spaces before the actual “.vbs” extension to deceive users.
How the Trojanized Plugin Executes
When executed, the VBS script retrieves a decoy document alongside an “Evernote.zip” package containing a complete installation of Notepad++ version 8.8.3 and a compromised plugin folder. The critical payload resides within “/plugins/NppExport/” where a malicious library named “NppExport.dll” replaces the legitimate plugin file. The script creates a randomized directory under %PUBLIC%, extracts the archive contents, and launches notepad++.exe, which automatically loads the trojanized DLL upon startup without triggering security alerts.
This exploitation technique leverages Notepad++’s standard plugin-loading behavior and relates to the previously disclosed CVE-2025-56383 DLL-hijacking issue affecting version 8.8.3. However, CERT-UA reports that the Notepad++ development team disputes the CVE classification, arguing it represents standard plugin architecture rather than a vulnerability.
Understanding the Multi-Stage Payload
The malicious NppExport.dll, tracked as LUNCHPOKE, creates a hidden Libraries folder and extracts a password-protected “updater.rar” archive containing “RemoteLibUpdater.exe” and “InitTest.dll.” To establish persistence, it copies Windows’ legitimate schtasks.exe and registers a scheduled task with a randomized name that relaunches RemoteLibUpdater.exe every three minutes using the arguments “setup nodisplay.”
RemoteLibUpdater.exe is classified as BURNYBEAR, functioning as a loader for InitTest.dll. When BURNYBEAR runs without its expected arguments, it switches to a resource-exhaustion routine that deliberately consumes RAM and CPU—potentially serving as an anti-analysis or decoy mechanism.
InitTest.dll represents an upgraded MATCHBOIL.V2 loader, previously identified in earlier UAC-0099 campaigns alongside malware families like MATCHWOK and DRAGSTARE. The enhanced version maintains core functions including scheduled-task persistence, configuration updates with command-and-control addresses, and secondary payload downloads. The new variant also leverages WinRAR to unpack downloaded components, retrieving the utility from Dropbox if not already installed on the target system.
Recommended Defense Measures
CERT-UA urges administrators to maintain current software versions, noting that as of July 21, 2026, secure versions include WinRAR 7.23, 7-Zip 26.02, and Notepad++ 8.9.7. Organizations should scrutinize unsolicited ZIP attachments referencing government correspondence, monitor for unauthorized DLLs in application plugin directories, and investigate scheduled tasks with randomized naming patterns as potential indicators of this ongoing UAC-0099 campaign.
Source: Cybersecurity News