# UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware

> Ukrainian threat cluster UAC-0099, which historically hands off validated targets to APT44/Sandworm, distributes trojanized Notepad++ v8.8.3 archives that bundle a malicious NppExport.dll plugin exploiting the disputed plugin-loading behavior tracked as CVE-2025-56383. A VBS script disguised as a PDF retrieves a follow-on password-protected archive, chaining into the BurnyBear loader and the MatchBoil V2 final payload, with LunchPoke establishing scheduled-task persistence.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T18:21:22.191Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1657
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-lunchpoke-notepad-plugin-campaign-tl-2026-1657.webp?v=01e90e95 (Threadlinqs threat intel: UAC-0099 LunchPoke Notepad++ Plugin: Detection & IOCs (TL-2026-1657) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-1657
- **Severity:** HIGH (CVSS 8.4)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAC-0099 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25
- **CVEs:** CVE-2025-56383

## Description

In July 2026, BleepingComputer (citing analysis attributed to CERT-UA visibility into Ukrainian-targeted intrusion activity) reported a campaign by UAC-0099, a Ukrainian-focused initial-access cluster active since at least May 2023 that has previously conducted reconnaissance and validated-target handoffs feeding into APT44/Sandworm (aka Iron Viking, Voodoo Bear, Seashell Blizzard, FROZENBARENTS) operations. The campaign trojanizes the popular open-source text editor Notepad++ (legitimate build v8.8.3) by bundling it inside an archive (Evernote.zip) alongside a malicious replacement for the NppExport.dll plugin, a password-protected updater.rar, and a copy of WinRAR.

The infection begins with a VBS script disguised as a PDF document (a classic double-extension / icon-spoofing lure) which, when opened by a victim, retrieves the Evernote.zip archive from attacker infrastructure. The VBS installs the bundled package into a randomly-named directory to evade static path-based detections, then launches Notepad++, which loads the malicious NppExport.dll through the application's standard (and, per the vendor, intentional) plugin-loading mechanism — tracked as CVE-2025-56383, a DLL/plugin-replacement flaw disputed by the Notepad++ team, who characterize it as an abuse of intended functionality requiring local write access to the plugins directory rather than a true vulnerability. The malicious plugin, internally identified by researchers as LunchPoke, creates a scheduled task for persistence and extracts the bundled password-protected updater.rar using the co-delivered WinRAR binary.

Extraction of updater.rar drops RemoteLibUpdater.exe and InitTest.dll, which execute the BurnyBear loader. BurnyBear acts as an intermediate loader for the final payload and additionally includes a fallback resource-exhaustion routine that can drive target RAM/CPU utilization to disrupt or degrade the host if follow-on stages fail to deploy — a denial-of-service capability layered onto what is otherwise a covert-access chain. BurnyBear ultimately loads MatchBoil V2, described as the campaign's final malware loader stage, positioned to receive further second-stage tooling consistent with UAC-0099's historical role of validating and handing off compromised Ukrainian targets to Sandworm/APT44 for follow-on destructive or espionage operations.

CVE-2025-56383 itself was originally assigned a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H per NVD) after a September 26, 2025 proof-of-concept release by researcher zer0t0, but the GitHub Security Advisory database rescored it to 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and it is formally marked DISPUTED. The Notepad++ development team (led by Don Ho) publicly rejected the classification, calling it 'one of the most absurd entries in the National Vulnerability Database' and noting that exploitation requires an attacker already possess local write access to the Program Files installation directory (elevated privilege) or that Notepad++ be installed to a non-standard, unprivileged-writable directory — a precondition that, per the vendor, would already grant an attacker equivalent or greater capability via direct binary replacement. No official patch exists as of the reporting date; the fix track version is v8.9.7. This UAC-0099 campaign is notable precisely because it operationalizes the disputed 'non-issue' as a working in-the-wild abuse primitive against a widely deployed developer tool, and pairs it with an unrelated packaging vulnerability chain (7-Zip and WinRAR updates were also recommended, pointing to parallel abuse of archive-handling flaws in the toolchain used to unpack payloads).

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1204.002 User Execution: Malicious File
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1574.001 DLL
- T1036.007 Masquerading: Double File Extension
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1218.011 Rundll32
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1496 Resource Hijacking
- T1499.001 OS Exhaustion Flood
- T1587.001 Develop Capabilities: Malware
- T1583 Acquire Infrastructure
- T1547 Boot or Logon Autostart Execution
- T1555 Credentials from Password Stores
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Password-Protected Archive Extraction to BurnyBear/MatchBoil Execution Chain with Resource-Exhaustion Fallback** (`TL-2026-1657-SPL-003`)

Detects the password-protected updater.rar extraction (via WinRAR/7-Zip non-interactive password flags) immediately followed by execution of RemoteLibUpdater.exe/InitTest.dll (BurnyBear loader) and, optionally, a subsequent sustained CPU/RAM spike consistent with BurnyBear's fallback resource-exhaustion routine when the MatchBoil V2 final payload fails to deploy.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1105, T1071.001, T1499.001, T1496
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where (match(CommandLine, "(?i)updater\.rar") AND match(CommandLine, "(?i)-p\S*")) OR match(Image, "(?i)\\\\RemoteLibUpdater\.exe$") OR match(CommandLine, "(?i)InitTest\.dll")
| eval stage=case(match(CommandLine,"(?i)updater\.rar"),"archive_extraction", match(Image,"(?i)RemoteLibUpdater"),"loader_exec", 1=1,"other")
| table _time, ComputerName, User, Image, CommandLine, ParentImage, stage
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine has "updater.rar" and ProcessCommandLine matches regex @"-p\S*")
   or FileName =~ "RemoteLibUpdater.exe"
   or ProcessCommandLine has "InitTest.dll"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc
```

### Sigma

```yaml
title: Archive Extraction to BurnyBear/MatchBoil Execution Chain (Evernote.zip / updater.rar)
id: 6f0e1a2b-1657-4c1e-9c1a-uac0099archive1
status: experimental
description: Detects password-protected extraction of updater.rar followed by execution of RemoteLibUpdater.exe/InitTest.dll, the BurnyBear intermediate loader stage preceding the MatchBoil V2 final payload and its resource-exhaustion fallback in the UAC-0099 chain.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-23
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.001
    - attack.impact
    - attack.t1499.001
    - attack.t1496
    - attack.tool.winrar
    - attack.actor.uac_0099
logsource:
    category: process_creation
detection:
    selection_extract:
        CommandLine|contains|all:
            - 'updater.rar'
            - '-p'
    selection_exec:
        Image|endswith:
            - '\RemoteLibUpdater.exe'
    condition: selection_extract or selection_exec
falsepositives:
    - IT staff extracting unrelated password-protected archives named updater.rar for legitimate software updates
level: high
```

**Known false positives:**

- Legitimate password-protected software update packages coincidentally named updater.rar

**Tuning notes:** Correlate with the plugin-load detection (TL-2026-1657-SPL-002) to raise confidence and reduce standalone false positives on legitimate archive-based deployment tooling; add a follow-up CPU/RAM anomaly rule on the descendant process tree for the resource-exhaustion fallback.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Double-Extension VBS-as-PDF Lure Execution (UAC-0099 Initial Access) (locked: unlock with TL Creds)
- Unsigned Plugin Load into Notepad++ Correlated with Scheduled Task Persistence (CVE-2025-56383 / LunchPoke) (locked: unlock with TL Creds)
- Password-Protected Archive Extraction to BurnyBear/MatchBoil Execution Chain (locked: unlock with TL Creds)
- Double-Extension VBS-as-PDF Lure Execution (UAC-0099) (locked: unlock with TL Creds)
- Notepad++ Plugin Load with Unsigned/Mismatched Hash (CVE-2025-56383 / LunchPoke) (locked: unlock with TL Creds)
- Scheduled Task Creation Immediately Following Third-Party App Plugin Load (LunchPoke Persistence -> BurnyBear/MatchBoil Handoff) (locked: unlock with TL Creds)
- Double-Extension VBS-as-PDF Lure Execution (UAC-0099 Initial Access) (locked: unlock with TL Creds)
- Unsigned/Mismatched-Hash Plugin Load into Notepad++ (CVE-2025-56383 / LunchPoke) with Immediate Scheduled Task (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Hackers abuse Notepad++ plugins to stealthily install malware](https://www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/)
- [CVE Record: CVE-2025-56383](https://www.cve.org/CVERecord?id=CVE-2025-56383)
- [NVD - CVE-2025-56383](https://nvd.nist.gov/vuln/detail/CVE-2025-56383)
- [GHSA-fq6p-2qgq-54m8 - Notepad++ DLL Hijacking](https://github.com/advisories/GHSA-fq6p-2qgq-54m8)
- [v8.8.6 release: Clarifying the CVE-2025-56383 Non-Issue](https://notepad-plus-plus.org/news/v886-released/)
- [Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0?](https://www.levelblue.com/blogs/spiderlabs-blog/notepad-dll-hijacking-cve-2025-56383-cvss-8-4-or-cvss-0-0/)
- [CVE-2025-56383: The Essential Notepad++ Guide for Defenders](https://www.cyberproof.com/blog/cve-2025-56383-the-essential-notepad-guide-for-defenders/)
- [zer0t0/CVE-2025-56383-Proof-of-Concept](https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept)
- [UAC-0099 (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/uac-0099)
- [Notepad++ DLL Hijacking Vulnerability Let Attackers Execute Malicious Code](https://cybersecuritynews.com/notepad-hijacking-vulnerability/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1657