Ethical Hacking News
UAC-0099 has been spotted delivering malware via a fake Notepad++ plugin as part of its latest campaign. The attack chain uses a combination of phishing, VBScript, and DLL plugins to evade detection. To protect yourself, make sure you have the latest versions of Notepad++ and WinRAR installed, and be cautious when opening emails with image attachments that open URLs through link shorteners.
Russia-aligned threat actor UAC-0099 discovered delivering malware via a fake Notepad++ plugin in a phishing email. The attack uses a phishing email with an image attachment, leading to a file-sharing service and a ZIP archive containing malicious files. A malicious DLL plugin named NppExport.dll is used to unpack a password-protected archive, making detection challenging without running the plugin. The LUNCHPOKE utility creates a directory and extracts contents of an archive using a password, while copying schtasks.exe to a file. The schedule task runs InitTest.dll every three minutes, which is a modified version of MATCHBOIL capable of fetching and running additional payloads. RemoteLibUpdater.exe (BURNYBEAR) has an unusual sabotage behavior that exhausts computer resources if launched incorrectly without arguments.
In a recent development that highlights the ever-evolving nature of cyber threats, researchers have discovered a new campaign by the Russia-aligned threat actor UAC-0099. The group, known for its sophisticated tactics and ability to adapt to changing security landscapes, has been observed delivering malware via a fake Notepad++ plugin. This malicious plugin is embedded within a phishing email that appears to be legitimate, making it challenging for unsuspecting victims to identify the potential threat.
The attack begins with a phishing email that contains an image attachment. Clicking on this image opens a URL hidden behind a link shortener, which redirects to a file-sharing service such as EasySend[.]co where a ZIP archive waits. Inside the ZIP is a VBScript file disguised as a PDF document. When the victim runs the VBScript, two things happen simultaneously: a legitimate decoy PDF downloads and opens in front of the victim, while in the background the script fetches a second archive called Evernote.zip.
The contents of this Evernote.zip archive contain a full working copy of Notepad++ version 8.8.3, as well as a malicious DLL plugin named NppExport.dll. This plugin is designed to use the bundled WinRAR binary to unpack a password-protected archive that contains two files: RemoteLibUpdater.exe and InitTest.dll. The RemoteLibUpdater.exe file copies these files to a specific directory and creates a scheduled task that runs InitTest.dll every three minutes.
This malicious DLL, codenamed LUNCHPOKE by CERT-UA, is the primary component of the attack chain. It uses the bundled WinRAR executable to unpack the password-protected archive, making it challenging for the victim to detect the malware without running the plugin. The LUNCHPOKE utility has two main purposes: to create a directory and extract the contents of the archive using a password; and to copy the standard utility schtasks.exe to the file %PUBLIC%\Wallpapers\Background.exe.
The schedule task created by LUNCHPOKE is designed to run InitTest.dll every three minutes. This DLL, which is a modified version of MATCHBOIL, a C#-based loader capable of fetching and running additional payloads, serves as the main payload of the attack. The update indicates active development on the toolchain rather than a static deployment.
Furthermore, the RemoteLibUpdater.exe file, also known as BURNYBEAR, has an unusual built-in sabotage behavior. If launched incorrectly without specifying arguments, it activates logic designed to exhaust computer resources (RAM and CPU). This behavior serves two purposes: making behavioral analysis harder by producing unexpected output if someone runs the binary without the correct arguments, and providing a rough sandbox detection mechanism since automated analysis environments often execute binaries without arguments.
The campaign's use of a bundled legitimate WinRAR executable rather than relying on one already installed is notable. It means that the attack chain does not depend on the victim having a vulnerable version present, making the update recommendation more relevant as a general hygiene measure than as a specific remediation for this particular campaign.
Organizations receiving unexpected emails with image attachments that open URLs through link shorteners should treat those as high-risk regardless of what the displayed content looks like. The UAC-0099 group's latest campaign highlights the importance of staying vigilant and up-to-date with security patches, particularly when it comes to Notepad++ and WinRAR.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Rise-of-Advanced-Persistent-Threats-UAC-0099s-Malicious-Notepad-Plugin-Campaign-ehn.shtml
https://securityaffairs.com/195923/cyber-warfare-2/uac-0099-is-now-hiding-malware-inside-a-fake-notepad-plugin-to-target-ukrainian-organizations.html
Published: Fri Jul 24 06:44:58 2026 by llama3.2 3B Q4_K_M
