UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware
UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to (TL-2026-1657), also tracked as Notepad++ Plugin Loading Campaign, is a high-severity malware campaign scored CVSS 8.4, first published 2026-07-23. It is attributed to UAC-0099 (Russia) with medium confidence, affects Notepad++ Team Notepad++, references 1 CVE (CVE-2025-56383), maps to 25 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1657
- Threat ID
- TL-2026-1657
- Also known as
- Notepad++ Plugin Loading Campaign, LunchPoke Campaign
- Severity
- HIGH
- CVSS
- 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-23
- Last reviewed
- 2026-07-23
- Attribution
- UAC-0099
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, critical infrastructure, technology
- Target regions
- ukraine, Europe
- Detection rules
- 9
- Indicators of compromise
- 25
- Updates
- 2026-07-23 · revalidated 1× · latest source
Malware and tooling in UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
Malware and tooling: BurnyBear, LunchPoke, MatchBoil V2, WinRAR (co-delivered)
Ukrainian threat cluster UAC-0099, which historically hands off validated targets to APT44/Sandworm, distributes trojanized Notepad++ v8.8.3 archives that bundle a malicious NppExport.dll plugin exploiting the disputed plugin-loading behavior tracked as CVE-2025-56383. A VBS script disguised as a PDF retrieves a follow-on password-protected archive, chaining into the BurnyBear loader and the MatchBoil V2 final payload, with LunchPoke establishing scheduled-task persistence.
How UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to works
In July 2026, BleepingComputer (citing analysis attributed to CERT-UA visibility into Ukrainian-targeted intrusion activity) reported a campaign by UAC-0099, a Ukrainian-focused initial-access cluster active since at least May 2023 that has previously conducted reconnaissance and validated-target handoffs feeding into APT44/Sandworm (aka Iron Viking, Voodoo Bear, Seashell Blizzard, FROZENBARENTS) operations. The campaign trojanizes the popular open-source text editor Notepad++ (legitimate build v8.8.3) by bundling it inside an archive (Evernote.zip) alongside a malicious replacement for the NppExport.dll plugin, a password-protected updater.rar, and a copy of WinRAR.
The infection begins with a VBS script disguised as a PDF document (a classic double-extension / icon-spoofing lure) which, when opened by a victim, retrieves the Evernote.zip archive from attacker infrastructure. The VBS installs the bundled package into a randomly-named directory to evade static path-based detections, then launches Notepad++, which loads the malicious NppExport.dll through the application's standard (and, per the vendor, intentional) plugin-loading mechanism — tracked as CVE-2025-56383, a DLL/plugin-replacement flaw disputed by the Notepad++ team, who characterize it as an abuse of intended functionality requiring local write access to the plugins directory rather than a true vulnerability. The malicious plugin, internally identified by researchers as LunchPoke, creates a scheduled task for persistence and extracts the bundled password-protected updater.rar using the co-delivered WinRAR binary.
Extraction of updater.rar drops RemoteLibUpdater.exe and InitTest.dll, which execute the BurnyBear loader. BurnyBear acts as an intermediate loader for the final payload and additionally includes a fallback resource-exhaustion routine that can drive target RAM/CPU utilization to disrupt or degrade the host if follow-on stages fail to deploy — a denial-of-service capability layered onto what is otherwise a covert-access chain. BurnyBear ultimately loads MatchBoil V2, described as the campaign's final malware loader stage, positioned to receive further second-stage tooling consistent with UAC-0099's historical role of validating and handing off compromised Ukrainian targets to Sandworm/APT44 for follow-on destructive or espionage operations.
CVE-2025-56383 itself was originally assigned a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H per NVD) after a September 26, 2025 proof-of-concept release by researcher zer0t0, but the GitHub Security Advisory database rescored it to 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and it is formally marked DISPUTED. The Notepad++ development team (led by Don Ho) publicly rejected the classification, calling it 'one of the most absurd entries in the National Vulnerability Database' and noting that exploitation requires an attacker already possess local write access to the Program Files installation directory (elevated privilege) or that Notepad++ be installed to a non-standard, unprivileged-writable directory — a precondition that, per the vendor, would already grant an attacker equivalent or greater capability via direct binary replacement. No official patch exists as of the reporting date; the fix track version is v8.9.7. This UAC-0099 campaign is notable precisely because it operationalizes the disputed 'non-issue' as a working in-the-wild abuse primitive against a widely deployed developer tool, and pairs it with an unrelated packaging vulnerability chain (7-Zip and WinRAR updates were also recommended, pointing to parallel abuse of archive-handling flaws in the toolchain used to unpack payloads).
MITRE ATT&CK techniques used in TL-2026-1657
Collection
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Masquerading: Double File Extension; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1218.011 Rundll32
Execution
T1053.005 Scheduled Task/Job: Scheduled Task; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Impact
T1496 Resource Hijacking; T1499.001 OS Exhaustion Flood
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
T1555 Credentials from Password Stores
collection
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment
stealth
Resource Development
T1583 Acquire Infrastructure; T1587.001 Develop Capabilities: Malware
Affected products and versions in UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
- Notepad++ Team — Notepad++
Vulnerable versions: 8.8.3; 8.8.5
Fixed in: 8.9.7 - Igor Pavlov — 7-Zip
Vulnerable versions: pre-26.02
Fixed in: 26.02 - RARLAB — WinRAR
Vulnerable versions: pre-7.23
Fixed in: 7.23
Remediation for UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
Patches
- Upgrade Notepad++ to v8.9.7 or later
- Upgrade 7-Zip to v26.02 or later
- Upgrade WinRAR to v7.23 or later
Immediate actions
- Set NTFS ACLs on the Notepad++ plugins directory (e.g. C:\Program Files\Notepad++\plugins\) so only Administrators/SYSTEM have write access
- Block execution and delivery of VBS scripts disguised as PDF attachments at the email gateway and endpoint
- Hunt for scheduled tasks created outside standard IT change windows, particularly those referencing randomly-named directories
- Hunt for NppExport.dll or other Notepad++ plugin DLLs with hashes that do not match vendor-signed releases
- Isolate and forensically image any host that executed RemoteLibUpdater.exe or InitTest.dll
Workarounds
- Restrict write access to the Notepad++ installation and plugins directories to Administrators/SYSTEM only
- Avoid installing Notepad++ or other plugin-capable applications outside default, ACL-protected Program Files locations
- Disable or remove unused Notepad++ plugins, including NppExport, if not required by users
Longer-term hardening
- Deploy File Integrity Monitoring (FIM) with hash baselining on all third-party application plugin/extension directories
- Implement application allowlisting / code-signing enforcement restricting DLL loading to vendor-signed binaries
- Centralize deployment and patching of developer tools (Notepad++, 7-Zip, WinRAR) via SCCM/Intune rather than ad hoc user installs
- Deploy EDR behavioral detection for archive-extraction-to-execution chains and process-injection-adjacent loader behavior
- Establish detection content correlating file-write events to plugins directories with subsequent unsigned-module loads
CVEs associated with UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
Weaknesses (CWE) in UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
CWE-427, CWE-77, CWE-506
Timeline of UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
- Per CERT-UA's fuller history, UAC-0099 begins operations against Ukrainian government and media entities as early as mid-2022, initially deploying the LONEPAGE PowerShell loader (predates the previously recorded 2023-05-01 first-active date).
- UAC-0099 first documented as active, targeting Ukrainian organizations with PowerShell/VBS-based initial access chains.
- CERT-UA formally documents UAC-0099 as a distinct threat cluster following observed attacks on state organizations and media.
- UAC-0099 resurfaces with an expanded campaign wave against government, forestry, forensic, and manufacturing organizations, incorporating a WinRAR exploitation vector alongside LNK/HTA delivery.
- CERT-UA publishes bulletin CERT-UA#12463 detailing prior UAC-0099 violation activity.
- UAC-0099 launches a campaign wave using court-summons phishing lures via UKR.NET distributing HTA files that deploy a revamped C# toolkit (MATCHBOIL, MATCHWOK, DRAGSTARE) against Ukraine's defense sector.
- CVE-2025-56383 assigned after researcher zer0t0 publishes a proof-of-concept demonstrating DLL/plugin replacement in Notepad++ v8.8.3, with an initial CVSS 3.1 score of 8.4.
- Notepad++ maintainer Don Ho publicly disputes the CVE classification in the v8.8.6 release notes, calling it a non-issue absent elevated local access.
- CybersecurityNews publishes independent coverage of the Notepad++ DLL hijacking vulnerability, amplifying awareness of the disputed CVE ahead of any observed in-the-wild abuse.
- LevelBlue SpiderLabs publishes a technical analysis weighing the CVSS 8.4 vs. CVSS 0.0 scoring debate for CVE-2025-56383, dissecting the plugin-loading mechanism the later UAC-0099 campaign would abuse.
- CyberProof publishes an essential-guide blog for defenders on CVE-2025-56383, providing early hardening and detection recommendations for the Notepad++ plugin-loading behavior.
- GitHub Security Advisory GHSA-fq6p-2qgq-54m8 is last updated, rescoring the vulnerability to CVSS 6.5 and formally marking it disputed.
- CERT-UA visibility identifies UAC-0099 distributing trojanized Notepad++ v8.8.3 archives (Evernote.zip) bundling the malicious NppExport.dll plugin against Ukrainian targets.
- Analysts identify the full infection chain: VBS-disguised-as-PDF lure to LunchPoke plugin persistence to BurnyBear loader to MatchBoil V2 final payload.
- CERT-UA notes current secure software versions for remediation guidance: Notepad++ 8.9.7, WinRAR 7.23, 7-Zip 26.02.
- BleepingComputer publishes the first public report on the UAC-0099 Notepad++ plugin-abuse campaign, attributing initial-access linkage to APT44/Sandworm.
Update history for TL-2026-1657
- 2026-07-23 — UAC-0099 Abuses Trojanized Notepad++ NppExport Plugin (CVE-2025-56383) to Deploy LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2: What changed No field escalations — severity (HIGH), exploitability (ACTIVE), and status (ACTIVE) are unchanged and consistent between reports. The newer report substantially deepens the technical record: DLL-proxying mechanic (original-Npp
Sources cited for UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
- Hackers abuse Notepad++ plugins to stealthily install malware
- CVE Record: CVE-2025-56383
- NVD - CVE-2025-56383
- GHSA-fq6p-2qgq-54m8 - Notepad++ DLL Hijacking
- v8.8.6 release: Clarifying the CVE-2025-56383 Non-Issue
- Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0?
- CVE-2025-56383: The Essential Notepad++ Guide for Defenders
- zer0t0/CVE-2025-56383-Proof-of-Concept
- UAC-0099 (Threat Actor)
- Notepad++ DLL Hijacking Vulnerability Let Attackers Execute Malicious Code
Threats related to UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to
Detection coverage for TL-2026-1657
As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1657 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.