New malware campaign exploiting “Notepad++” identified

A warning has been issued regarding the UAC-0099 threat group, which loads a malicious DLL disguised as a plugin through the legitimate Notepad++ application. The campaign, observed since mid-summer 2026, employs the newly identified LUNCHPOKE and BURNYBEAR malware, along with an updated version of the MATCHBOIL.V2 loader.

The infection chain typically begins with a phishing email containing an image attachment. When the user clicks the image, a hyperlink often routed through a URL-shortening service is activated and redirects the user to a file-hosting platform.

A ZIP archive with a name such as “Attachments to the Order.zip” is subsequently downloaded from the platform. The archive contains a Visual Basic Script (VBS) file that employs a double-extension technique. Although the file appears to the user as a PDF document named “Factory District.pdf,” a long sequence of spaces conceals its actual “.vbs” extension.

Once executed, the VBS script downloads a decoy PDF document intended to avoid raising the user’s suspicion, along with another archive named “Evernote.zip.” This archive contains a complete copy of Notepad++ version 8.8.3, the application’s legitimate components and a plugin directory containing a malicious file named “NppExport.dll.” The ZIP archive also includes a password-protected archive named “updater.rar” and the WinRAR executable.

The script extracts the Notepad++ package into a randomly named directory under the public Windows profile, such as %PUBLIC%\Libs_<random>\Notepad\ and subsequently launches the notepad++.exe file.

As Notepad++ supports the loading of plugin libraries as part of its normal operation, launching the legitimate text editor causes the attacker-controlled “NppExport.dll” file to be loaded automatically. The malicious DLL is classified as LUNCHPOKE.

The malware creates a working directory under %PUBLIC%\Libraries\, extracts the contents of the password-protected archive and deploys the “RemoteLibUpdater.exe” and “InitTest.dll” files on the system. It then creates a copy of schtasks.exe, the legitimate Windows Task Scheduler utility and misleadingly renames it “Background.exe.”

A scheduled task named \W1n3r-U09oTy-Ap5\Updates is subsequently created on the system. To maintain persistence, the task launches “RemoteLibUpdater.exe” with the setup nodisplay arguments every three minutes.

The executable, identified as BURNYBEAR, deploys a payload named “InitTest.dll” on the system. It has also been determined that, when launched without the expected command-line arguments, the malware attempts to consume substantial memory and CPU resources on the compromised device.

The “InitTest.dll” file used during the final stage of the attack is an updated version of the MATCHBOIL malware, tracked as MATCHBOIL.V2. The DLL can create additional scheduled tasks, update command-and-control (C2) configurations, download further malicious payloads and extract downloaded components using WinRAR.

If WinRAR is not available on the compromised system, the malware can download it from Dropbox. This capability provides the threat actors with additional operational flexibility following the compromise of the system.

The Computer Emergency Response Center recommends that users and organizations update widely used software products, including “Notepad++”, “WinRAR” and “7-Zip” strengthen security measures against phishing attacks and monitor scripts delivered within archive files.