Skip to navigation

Threat reportMalwareTL-2026-1657

UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware

highACTIVE

Ukrainian threat cluster UAC-0099, which historically hands off validated targets to APT44/Sandworm, distributes trojanized Notepad++ v8.8.3 archives that bundle a malicious NppExport.dll plugin exploiting the disputed plugin-loading behavior tracked as CVE-2025-56383. A VBS script disguised as a PDF retrieves a follow-on password-protected archive, chaining into the BurnyBear loader and the MatchBoil V2 final payload, with LunchPoke establishing scheduled-task persistence.

Key facts for LunchPoke Notepad++ plugin campaign

IdentifiersTL-2026-1657, CVE-2025-56383
Also known asNotepad++ Plugin Loading Campaign, LunchPoke Campaign
SeverityHIGH
CVSS8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploitation statusExploited in the wild
EPSSCVE-2025-56383: 0.2% (18.8th percentile)
Affected productsNotepad++ Team Notepad++; Igor Pavlov 7-Zip; RARLAB WinRAR
Weaknesses (CWE)CWE-427, CWE-77, CWE-506
AttributionUAC-0099 (medium confidence)
Nation-state nexusRussia
MalwareBurnyBear, LunchPoke, MatchBoil V2
ToolsWinRAR (co-delivered)
MITRE ATT&CK techniquesT1005 Data from Local System, T1016 System Network Configuration Discovery, T1027 Obfuscated Files or Information, T1036.005 Match Legitimate Resource Name or Location, T1036.007 Masquerading: Double File Extension, T1053.005 Scheduled Task/Job: Scheduled Task, T1059.005 Command and Scripting Interpreter: Visual Basic, T1071.001 Application Layer Protocol: Web Protocols, T1082 System Information Discovery, T1083 File and Directory Discovery, T1105 Ingress Tool Transfer, T1140 Deobfuscate/Decode Files or Information and 13 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, defense, critical infrastructure, technology
Target regionsukraine, Europe
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for LunchPoke Notepad++ plugin campaign

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1657 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Password-Protected Archive Extraction to BurnyBear/MatchBoil Execution Chain with Resource-Exhaustion Fallback

Detects the password-protected updater.rar extraction (via WinRAR/7-Zip non-interactive password flags) immediately followed by execution of RemoteLibUpdater.exe/InitTest.dll (BurnyBear loader) and, optionally, a subsequent sustained CPU/RAM spike consistent with BurnyBear's fallback resource-exhaustion routine when the MatchBoil V2 final payload fails to deploy.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1105, T1071.001, T1499.001, T1496
  • Data sources: sysmon, windows_security
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where (match(CommandLine, "(?i)updater\.rar") AND match(CommandLine, "(?i)-p\S*")) OR match(Image, "(?i)\\\\RemoteLibUpdater\.exe$") OR match(CommandLine, "(?i)InitTest\.dll")
| eval stage=case(match(CommandLine,"(?i)updater\.rar"),"archive_extraction", match(Image,"(?i)RemoteLibUpdater"),"loader_exec", 1=1,"other")
| table _time, ComputerName, User, Image, CommandLine, ParentImage, stage
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine has "updater.rar" and ProcessCommandLine matches regex @"-p\S*")
   or FileName =~ "RemoteLibUpdater.exe"
   or ProcessCommandLine has "InitTest.dll"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

Sigma

title: Archive Extraction to BurnyBear/MatchBoil Execution Chain (Evernote.zip / updater.rar)
id: 6f0e1a2b-1657-4c1e-9c1a-uac0099archive1
status: experimental
description: Detects password-protected extraction of updater.rar followed by execution of RemoteLibUpdater.exe/InitTest.dll, the BurnyBear intermediate loader stage preceding the MatchBoil V2 final payload and its resource-exhaustion fallback in the UAC-0099 chain.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-23
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.001
    - attack.impact
    - attack.t1499.001
    - attack.t1496
    - attack.tool.winrar
    - attack.actor.uac_0099
logsource:
    category: process_creation
detection:
    selection_extract:
        CommandLine|contains|all:
            - 'updater.rar'
            - '-p'
    selection_exec:
        Image|endswith:
            - '\RemoteLibUpdater.exe'
    condition: selection_extract or selection_exec
falsepositives:
    - IT staff extracting unrelated password-protected archives named updater.rar for legitimate software updates
level: high

Known false positives:

  • Legitimate password-protected software update packages coincidentally named updater.rar

Tuning notes: Correlate with the plugin-load detection (TL-2026-1657-SPL-002) to raise confidence and reduce standalone false positives on legitimate archive-based deployment tooling; add a follow-up CPU/RAM anomaly rule on the descendant process tree for the resource-exhaustion fallback.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Double-Extension VBS-as-PDF Lure Execution (UAC-0099 Initial Access) · unlock with TL Creds
  • Unsigned Plugin Load into Notepad++ Correlated with Scheduled Task Persistence (CVE-2025-56383 / LunchPoke) · unlock with TL Creds
  • Password-Protected Archive Extraction to BurnyBear/MatchBoil Execution Chain · unlock with TL Creds
  • Double-Extension VBS-as-PDF Lure Execution (UAC-0099) · unlock with TL Creds
  • Notepad++ Plugin Load with Unsigned/Mismatched Hash (CVE-2025-56383 / LunchPoke) · unlock with TL Creds
  • Scheduled Task Creation Immediately Following Third-Party App Plugin Load (LunchPoke Persistence -> BurnyBear/MatchBoil Handoff) · unlock with TL Creds
  • Double-Extension VBS-as-PDF Lure Execution (UAC-0099 Initial Access) · unlock with TL Creds
  • Unsigned/Mismatched-Hash Plugin Load into Notepad++ (CVE-2025-56383 / LunchPoke) with Immediate Scheduled Task · unlock with TL Creds

Indicators of compromise for LunchPoke Notepad++ plugin campaign

As of 2026-07-23, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-1657.

25 indicators of compromise · unlock with TL Creds. Compare plans

How LunchPoke Notepad++ plugin campaign works

In July 2026, BleepingComputer (citing analysis attributed to CERT-UA visibility into Ukrainian-targeted intrusion activity) reported a campaign by UAC-0099, a Ukrainian-focused initial-access cluster active since at least May 2023 that has previously conducted reconnaissance and validated-target handoffs feeding into APT44/Sandworm (aka Iron Viking, Voodoo Bear, Seashell Blizzard, FROZENBARENTS) operations. The campaign trojanizes the popular open-source text editor Notepad++ (legitimate build v8.8.3) by bundling it inside an archive (Evernote.zip) alongside a malicious replacement for the NppExport.dll plugin, a password-protected updater.rar, and a copy of WinRAR.

The infection begins with a VBS script disguised as a PDF document (a classic double-extension / icon-spoofing lure) which, when opened by a victim, retrieves the Evernote.zip archive from attacker infrastructure. The VBS installs the bundled package into a randomly-named directory to evade static path-based detections, then launches Notepad++, which loads the malicious NppExport.dll through the application's standard (and, per the vendor, intentional) plugin-loading mechanism — tracked as CVE-2025-56383, a DLL/plugin-replacement flaw disputed by the Notepad++ team, who characterize it as an abuse of intended functionality requiring local write access to the plugins directory rather than a true vulnerability. The malicious plugin, internally identified by researchers as LunchPoke, creates a scheduled task for persistence and extracts the bundled password-protected updater.rar using the co-delivered WinRAR binary.

Extraction of updater.rar drops RemoteLibUpdater.exe and InitTest.dll, which execute the BurnyBear loader. BurnyBear acts as an intermediate loader for the final payload and additionally includes a fallback resource-exhaustion routine that can drive target RAM/CPU utilization to disrupt or degrade the host if follow-on stages fail to deploy — a denial-of-service capability layered onto what is otherwise a covert-access chain. BurnyBear ultimately loads MatchBoil V2, described as the campaign's final malware loader stage, positioned to receive further second-stage tooling consistent with UAC-0099's historical role of validating and handing off compromised Ukrainian targets to Sandworm/APT44 for follow-on destructive or espionage operations.

CVE-2025-56383 itself was originally assigned a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H per NVD) after a September 26, 2025 proof-of-concept release by researcher zer0t0, but the GitHub Security Advisory database rescored it to 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and it is formally marked DISPUTED. The Notepad++ development team (led by Don Ho) publicly rejected the classification, calling it 'one of the most absurd entries in the National Vulnerability Database' and noting that exploitation requires an attacker already possess local write access to the Program Files installation directory (elevated privilege) or that Notepad++ be installed to a non-standard, unprivileged-writable directory — a precondition that, per the vendor, would already grant an attacker equivalent or greater capability via direct binary replacement. No official patch exists as of the reporting date; the fix track version is v8.9.7. This UAC-0099 campaign is notable precisely because it operationalizes the disputed 'non-issue' as a working in-the-wild abuse primitive against a widely deployed developer tool, and pairs it with an unrelated packaging vulnerability chain (7-Zip and WinRAR updates were also recommended, pointing to parallel abuse of archive-handling flaws in the toolchain used to unpack payloads).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Masquerading: Double File Extension; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1218.011 Rundll32

Execution

T1053.005 Scheduled Task/Job: Scheduled Task; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Impact

T1496 Resource Hijacking; T1499.001 OS Exhaustion Flood

Persistence

T1547 Boot or Logon Autostart Execution

Credential Access

T1555 Credentials from Password Stores

collection

T1560 Archive Collected Data

Initial Access

T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment

stealth

T1574.001 DLL

Resource Development

T1583 Acquire Infrastructure; T1587.001 Develop Capabilities: Malware

Remediation for LunchPoke Notepad++ plugin campaign

Patches

  • Upgrade Notepad++ to v8.9.7 or later
  • Upgrade 7-Zip to v26.02 or later
  • Upgrade WinRAR to v7.23 or later

Immediate actions

  • Set NTFS ACLs on the Notepad++ plugins directory (e.g. C:\Program Files\Notepad++\plugins\) so only Administrators/SYSTEM have write access
  • Block execution and delivery of VBS scripts disguised as PDF attachments at the email gateway and endpoint
  • Hunt for scheduled tasks created outside standard IT change windows, particularly those referencing randomly-named directories
  • Hunt for NppExport.dll or other Notepad++ plugin DLLs with hashes that do not match vendor-signed releases
  • Isolate and forensically image any host that executed RemoteLibUpdater.exe or InitTest.dll

Workarounds

  • Restrict write access to the Notepad++ installation and plugins directories to Administrators/SYSTEM only
  • Avoid installing Notepad++ or other plugin-capable applications outside default, ACL-protected Program Files locations
  • Disable or remove unused Notepad++ plugins, including NppExport, if not required by users

Longer-term hardening

  • Deploy File Integrity Monitoring (FIM) with hash baselining on all third-party application plugin/extension directories
  • Implement application allowlisting / code-signing enforcement restricting DLL loading to vendor-signed binaries
  • Centralize deployment and patching of developer tools (Notepad++, 7-Zip, WinRAR) via SCCM/Intune rather than ad hoc user installs
  • Deploy EDR behavioral detection for archive-extraction-to-execution chains and process-injection-adjacent loader behavior
  • Establish detection content correlating file-write events to plugins directories with subsequent unsigned-module loads

Affected and fixed versions

  • Notepad++ Team — Notepad++
    Vulnerable versions: 8.8.3; 8.8.5
    Fixed in: 8.9.7
  • Igor Pavlov — 7-Zip
    Vulnerable versions: pre-26.02
    Fixed in: 26.02
  • RARLAB — WinRAR
    Vulnerable versions: pre-7.23
    Fixed in: 7.23

Timeline of LunchPoke Notepad++ plugin campaign

Last updated · revalidated 1× · latest source

  • Per CERT-UA's fuller history, UAC-0099 begins operations against Ukrainian government and media entities as early as mid-2022, initially deploying the locked-ioc-23 PowerShell loader (predates the previously recorded 2023-05-01 first-active date).
  • UAC-0099 first documented as active, targeting Ukrainian organizations with PowerShell/VBS-based initial access chains.
  • CERT-UA formally documents UAC-0099 as a distinct threat cluster following observed attacks on state organizations and media.
  • UAC-0099 resurfaces with an expanded campaign wave against government, forestry, forensic, and manufacturing organizations, incorporating a WinRAR exploitation vector alongside LNK/HTA delivery.
  • CERT-UA publishes bulletin CERT-UA#12463 detailing prior UAC-0099 violation activity.
  • UAC-0099 launches a campaign wave using court-summons phishing lures via locked-ioc-24 distributing HTA files that deploy a revamped C# toolkit (locked-ioc-20, locked-ioc-22, locked-ioc-21) against Ukraine's defense sector.
  • CVE-2025-56383 assigned after researcher zer0t0 publishes a proof-of-concept demonstrating DLL/plugin replacement in Notepad++ v8.8.3, with an initial CVSS 3.1 score of 8.4.
  • Notepad++ maintainer Don Ho publicly disputes the CVE classification in the v8.8.6 release notes, calling it a non-issue absent elevated local access.
  • CybersecurityNews publishes independent coverage of the Notepad++ DLL hijacking vulnerability, amplifying awareness of the disputed CVE ahead of any observed in-the-wild abuse.
  • LevelBlue SpiderLabs publishes a technical analysis weighing the CVSS 8.4 vs. CVSS 0.0 scoring debate for CVE-2025-56383, dissecting the plugin-loading mechanism the later UAC-0099 campaign would abuse.
  • CyberProof publishes an essential-guide blog for defenders on CVE-2025-56383, providing early hardening and detection recommendations for the Notepad++ plugin-loading behavior.
  • GitHub Security Advisory GHSA-fq6p-2qgq-54m8 is last updated, rescoring the vulnerability to CVSS 6.5 and formally marking it disputed.
  • CERT-UA visibility identifies UAC-0099 distributing trojanized Notepad++ v8.8.3 archives (locked-ioc-15) bundling the malicious locked-ioc-13 plugin against Ukrainian targets.
  • Analysts identify the full infection chain: VBS-disguised-as-PDF lure to locked-ioc-18 plugin persistence to locked-ioc-19 loader to locked-ioc-14 final payload.
  • CERT-UA notes current secure software versions for remediation guidance: Notepad++ 8.9.7, WinRAR 7.23, 7-Zip 26.02.
  • BleepingComputer publishes the first public report on the UAC-0099 Notepad++ plugin-abuse campaign, attributing initial-access linkage to APT44/Sandworm.

Update history

Sources cited for LunchPoke Notepad++ plugin campaign

More from UAC-0099

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats