A Russia-aligned threat actor known as UAC-0099 has shifted tactics in its ongoing campaign against Ukrainian organizations, now using a trojanized Notepad++ plugin as the primary infection mechanism. CERT-UA published an advisory detailing the phishing campaign observed earlier this summer, marking a significant evolution for a group active since at least mid-2022 and previously known for exploiting WinRAR vulnerabilities.
How Does the Phishing Attack Begin?
The attack chain starts with a phishing email containing an image attachment. When clicked, the image opens a URL hidden behind a link shortener that redirects victims to file-sharing services like EasySend[.]co hosting a ZIP archive. Inside the archive sits a VBScript file disguised as a PDF document, with its name containing numerous spaces before the final .vbs extension, such as “Zavodskyi rayon.pdf .vbs”.
Executing the VBScript triggers two simultaneous actions: a legitimate decoy PDF downloads and opens to distract the victim, while the script secretly fetches a second archive called Evernote.zip in the background. This archive contains a complete working copy of Notepad++ version 8.8.3, a malicious DLL plugin named NppExport.dll, a password-protected RAR archive called updater.rar, and a legitimate WinRAR executable.
What Happens After Notepad++ Launches?
The VBScript extracts all components and launches Notepad++, which automatically loads NppExport.dll during startup. The victim sees a text editor open normally without any indication of compromise. CERT-UA has codenamed this malicious DLL LUNCHPOKE, whose primary function involves creating a specific directory and using the bundled WinRAR binary to unpack the password-protected archive.
According to CERT-UA, LUNCHPOKE creates the directory “%PUBLIC%\Libraries\fFthY3-Ytrevc3w-ab3\” and extracts two files from updater.rar: RemoteLibUpdater.exe and InitTest.dll. The malware then copies the standard schtasks.exe utility to “%PUBLIC%\Wallpapers\Background.exe” and establishes a scheduled task named “\W1n3r-U09oTy-Ap5\Updates” that executes RemoteLibUpdater.exe with arguments “setup nodisplay” every three minutes.
What Are BURNYBEAR and MATCHBOIL.V2?
RemoteLibUpdater.exe, classified as BURNYBEAR, functions as a loader designed to execute InitTest.dll. That DLL represents a modified version of MATCHBOIL, a C#-based loader capable of retrieving and running additional payloads, now designated MATCHBOIL.V2. The update indicates active development on the UAC-0099 toolchain.
BURNYBEAR includes an unusual sabotage feature. If launched without specifying arguments, instead of performing its intended function, BURNYBEAR activates logic designed to exhaust computer resources including RAM and CPU. This behavior serves dual purposes: complicating behavioral analysis by producing unexpected output and providing a rough sandbox detection mechanism, since automated analysis environments typically execute binaries without arguments.
What Should Organizations Do?
CERT-UA recommends updating WinRAR, 7-Zip, and Notepad++ to their latest versions to close known vulnerabilities that threat groups exploit. The campaign’s use of a bundled legitimate WinRAR executable means the attack chain doesn’t depend on victims having vulnerable versions already installed. Organizations should treat unexpected emails with image attachments that open URLs through link shorteners as high-risk regardless of displayed content.
Source: Security Affairs