Hackers abuse Notepad++ plugins to stealthily install malware
Hackers have been using Notepad++ plugins to install malware on victims' systems. The attackers deliver a ZIP archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin. The malware creates a scheduled task on Wi…
Intelligence analysis by Llama
Hackers are using Notepad++ plugins to install malware on victims' systems. The attackers deliver a ZIP archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke. The malware creates a scheduled task on Windows and extracts the contents of the RAR file.
Imagine you're using a popular text editor called Notepad++. Hackers are using this editor to secretly install malware on your computer. They do this by creating a fake plugin that looks like a normal plugin, but actually contains malicious code. When you open the plugin, it installs the malware and starts doing bad things on your computer.
Analysis
A New Modus Operandi for UAC-0099
Ukraine's CERT has uncovered a new attack chain attributed to the threat cluster UAC-0099. The attackers have changed their modus operandi and now deliver a ZIP archive with a VBS script disguised as a PDF document. When launched, the PDF retrieves another compressed file named Evernote.zip. The second archive contains a complete copy of the legitimate editor Notepad++ version 8.8.3, a malicious plugin (NppExport.dll), a password-protected archive (updater.rar), and the legitimate WinRAR executable.
How the Attack Works
The VBS script installs the package into a randomly named directory, launches Notepad++, and then loads the malicious NppExport.dll via the application's normal plugin-loading mechanism. The DLL is LunchPoke, a tool that creates a scheduled task on Windows and extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll. The executable in the RAR file is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader.
The Importance of Keeping Software Up to Date
CERT-UA advises system administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23, to prevent hackers from exploiting known flaws in existing products and enabling stealthy attacks.
Key points
- Hackers are using Notepad++ plugins to install malware on victims' systems.
- The attackers deliver a ZIP archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke.
- The malware creates a scheduled task on Windows and extracts the contents of the RAR file, including a loader for the MatchBoil V2 malware loader.
- CERT-UA advises system administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23.
If this development plays out positively, it could lead to increased awareness and vigilance among users and system administrators, resulting in fewer successful attacks and a safer online environment.
The realistic downside risks or failure modes include the possibility of the malware being more sophisticated and difficult to detect, or the attackers using this method to deliver more destructive payloads.
