Hackers Weaponize Notepad++ 8.8.3 to Silently Install MATCHBOIL.V2 Malware

CERT-UA has disclosed a significant shift in the tactics of threat cluster UAC-0099, revealing a novel infection chain that abuses a legitimate Notepad++ 8.8.3 executable to sideload malware, alongside an upgraded MATCHBOIL.V2 loader and two new tools named LUNCHPOKE and BURNYBEAR. The campaign, documented since mid-summer 2026, marks a notable evolution from the group’s earlier […] The post Hackers Weaponize Notepad++ 8.8.3 to Silently Install MATCHBOIL.V2 Malware appeared first on Cyber Security News.

CERT-UA has disclosed a significant shift in the tactics of threat cluster UAC-0099, revealing a novel infection chain that abuses a legitimate Notepad++ 8.8.3 executable to sideload malware, alongside an upgraded MATCHBOIL.V2 loader and two new tools named LUNCHPOKE and BURNYBEAR. The campaign, documented since mid-summer 2026, marks a notable evolution from the group’s earlier MATCHBOIL and MATCHWOK toolset that CERT-UA previously linked to phishing operations against Ukraine’s defense sector. The attack starts with a phishing email containing an embedded image that, when clicked, redirects victims through a shortened URL to a file-hosting service delivering a ZIP archive such as “Additions to the Order.zip”. Hackers Weaponize Notepad++ infection chain (Source: Cert) Inside is a VBS script using a double extension trick padding filenames with excessive spaces before the final “.vbs” so a file appears to end in “.pdf” a classic social-engineering technique also seen in earlier UAC-0099 campaigns using double archives. Once executed, the script drops a decoy PDF and a second archive, “Evernote.zip,” which contains a complete, legitimate Notepad++ 8.8.3 installation bundled with a rogue plugin. The VBS script extracts “Evernote.zip” into a randomized directory under %PUBLIC%\Libs_ and launches the genuine “notepad++.exe,” which automatically loads a malicious DLL disguised as “NppExport.dll” from the plugins folder. This works because Notepad++’s plugin-loading mechanism treats any DLL placed in its plugins directory as legitimate; its developers maintain this is intentional architecture rather than a vulnerability, fueling ongoing debate around CVE-2025-56383, which CERT-UA references only for search convenience without formally attributing the technique to it. This is distinct from the earlier Notepad++ supply-chain compromise involving hijacked update infrastructure (WinGUp), which required no local plugin abuse. “NppExport.dll,” tracked as LUNCHPOKE, extracts a password-protected archive (“updater.rar”) containing “RemoteLibUpdater.exe” and “InitTest.dll,” then copies the legitimate “schtasks.exe” binary to disguise a scheduled task launcher. MATCHBOIL.V2 functions (Source: cert) It creates a scheduled task that runs every three minutes to maintain persistence. “RemoteLibUpdater.exe,” identified as BURNYBEAR, is responsible for loading the final payload; if launched without proper arguments, it instead triggers resource-exhaustion behavior that consumes CPU and memory, likely as an anti-analysis or decoy mechanism. “InitTest.dll” is the updated MATCHBOIL.V2 variant, retaining core functionality from the original C#-based MATCHBOIL loader scheduled task creation, C2 configuration updates, and payload downloading while adding WinRAR-based extraction and the ability to fetch WinRAR from Dropbox if absent on the host. The original MATCHBOIL was designed to succeed the older LONEPAGE malware used by UAC-0099 and relied on HTTP headers containing hardware-derived identifiers for C2 communication. ComponentRoleNotable TraitLUNCHPOKEMalicious DLL loaderMasquerades as Notepad++ plugin BURNYBEARSecondary loaderResource-exhaustion fallback if misused MATCHBOIL.V2Final-stage loaderWinRAR-based payload extraction, Dropbox fallback CERT-UA urges administrators to keep common software updated, noting current versions as of July 21, 2026: WinRAR 7.23, 7-Zip 26.02, and Notepad++ 8.9.7, three major versions ahead of the abused 8.8.3 build. Given Notepad++’s history of being targeted by state-sponsored actors, including a separate supply-chain compromise attributed to the Lotus Blossom group earlier in 2026, organizations should treat outdated builds of widely used utilities as active initial-access vectors. Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN. The post Hackers Weaponize Notepad++ 8.8.3 to Silently Install MATCHBOIL.V2 Malware appeared first on Cyber Security News.