UAC-0099: The Fake Notepad++ Plugin That Weaponizes a Legitimate…

On July 24, 2026, CERT-UA disclosed a campaign by the UAC-0099 threat cluster: a counterfeit Notepad++ plugin serves as an initial-access vector against Ukrainian government and defense organizations. The technique exploits a by-design architectural behavior of the popular open-source editor — not a patchable vulnerability — making defense dependent on behavioral controls rather than software updates.

{"main_topic":"cybersecurity","topics":["malware","phishing","cve","zero-day","exploit"]}

On July 24, 2026, CERT-UA issued an advisory detailing a campaign by the UAC-0099 threat cluster: a counterfeit Notepad++ plugin is used as an initial-access vehicle against Ukrainian government and defense organizations. The technique does not exploit a patchable vulnerability but a by-design architectural behavior of the well-known open-source editor, making defense reliant on behavioral controls rather than software updates.

Key Takeaways

UAC-0099, a Russia-aligned cluster active since 2022, distributes malware by bundling Notepad++ v8.8.3 with a malicious DLL that impersonates the NppExport plugin.
The infection chain comprises three stages: LUNCHPOKE (persistence via a scheduled task every 3 minutes), BURNYBEAR (loader with resource-exhaustion anti-analysis), and MATCHBOIL.V2 (final payload with C2 capabilities).
ESET and Mandiant document UAC-0099 as an initial-access broker for APT44/Sandworm, the GRU-linked group that deployed wipers against Ukrainian universities, energy, and the grain sector in 2025.
The DLL sideloading vector is a by-design Notepad++ behavior that automatically loads DLLs present in the plugin directory, rendering the risk unpatchable.

The Mechanism: When a Plugin Architecture Becomes a Risk Factor

Notepad++ is designed to automatically load DLLs present in its plugin directory at startup. This legitimate architectural choice — which enables the editor's extensibility — becomes an attack vector when an adversary introduces a malicious DLL into the same directory structure as a legitimate installation. The signed Notepad++ binary loads the arbitrary code, inheriting the trust of the parent process.

In the campaign documented by CERT-UA, the "Evernote.zip" archive downloaded from the phishing chain contains three elements: the legitimate Notepad++ installer version 8.8.3, the NppExport.dll file renamed to the LUNCHPOKE malware, and an encrypted updater.rar archive. When the user launches the editor, the process automatically loads the malicious DLL without requiring any further action.

LUNCHPOKE establishes persistence by creating a scheduled task that triggers every 3 minutes. This task launches RemoteLibUpdater.exe, the BURNYBEAR component, which in turn loads InitTest.dll (MATCHBOIL.V2). The task frequency — 180 seconds — is unusually aggressive and suggests a priority on maintaining access over stealth.

BURNYBEAR and the Anti-Analysis That Inverts Sandbox Logic

The BURNYBEAR component introduces an anti-analysis technique documented by CERT-UA with technical precision: if the executable is launched without the correct command-line arguments, it does not exhibit malicious behavior or obvious errors. Instead, it activates logic designed to exhaust system resources, saturating RAM and CPU.

"if 'RemoteLibUpdater.exe' is launched incorrectly, namely without specifying arguments, BURNYBEAR instead activates logic designed to exhaust computer resources (RAM and processor)" — CERT-UA, as reported by The Hacker News

This mechanism inverts the traditional sandboxing paradigm. Automated analysis environments typically execute samples without specific parameters or with generic ones; BURNYBEAR exploits precisely this standard condition to make execution costly rather than revealing. The sample appears technically as a resource-consuming process, not as misbehaving malware — a profile that many analysis platforms do not flag as anomalous.

MATCHBOIL.V2, the final payload, is an updated C# loader compared to previous versions. It retains command-and-control communication and secondary payload download capabilities. For decompression of downloaded files it uses WinRAR; if the utility is not present on the system, the routine automatically downloads it from Dropbox. This external dependency chain introduces a potential observation point for defenders, though traffic to legitimate hosting services is notoriously difficult to filter without generating false positives.

From UAC-0099 to Sandworm: The Path from Access to Destruction

Documentation from ESET and Mandiant places UAC-0099 in a specific position within the Russia-aligned threat ecosystem: initial access broker. The cluster obtains the initial foothold, then transfers access to APT44/Sandworm, the GRU operational group responsible for high-profile destructive operations.

In 2025, Sandworm used accesses originated by UAC-0099 to deploy wiper malware against Ukrainian targets in three critical sectors: universities, energy, and agriculture (grain). The transition from initial compromise to data destruction is neither immediate nor automatic; the time between access and impact offers a detection window, but requires defenders to recognize the presence of UAC-0099 as a preliminary phase rather than a final objective.

The filename observed in this campaign — "Attachments to rozporyadjennya.zip," where the Ukrainian term means "order" or "directive" — indicates social-engineering crafting specific to the Ukrainian bureaucratic-military context. The use of the EasySend[.]co shortener and the intermediate file-sharing stage follow patterns documented in previous campaigns by the same cluster.

CVE-2025-56383 and the Case of the Unpatchable Vector

The National Vulnerability Database assigned identifier CVE-2025-56383 to a DLL hijacking issue in Notepad++ v8.8.3, with a CVSS 3.1 score of 8.4 (HIGH) per vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. However, the record carries a DISPUTED status: the Notepad++ developer contests the classification as a vulnerability, arguing that the behavior manifests only when the product is installed in a directory structure with write permissions for unprivileged users.

This dispute highlights the core of the technical problem. The UAC-0099 campaign does not exploit a vulnerability in the classic sense — there is no buffer overflow, no race condition, no missing input validation. The attack works because Notepad++ does exactly what it is designed to do: load plugins from its own directory. Bundling the legitimate installer with the malicious DLL is a distribution problem, not a code problem.

Consequently, no patch exists that eliminates the vector without breaking the plugin ecosystem on which the editor's utility relies for millions of users. Mitigations must operate at other levels: control of installation package integrity, restriction of plugin directories, monitoring of unsigned DLL loads by the notepad++.exe process.

Immediate Actions

CERT-UA has indicated concrete actions organizations can take to reduce exposure to this campaign and analogous vectors:

Update Notepad++ to version 8.9.7, which includes fixes for known security issues; the update does not eliminate the DLL sideloading vector but reduces the overall attack surface.
Keep 7-Zip updated to version 26.02 and WinRAR to version 7.23, components the attack chain uses or attempts to use for archive manipulation.
Check for unauthorized scheduled tasks with anomalous frequency, particularly those pointing to executables in temporary or download directories with generic names such as RemoteLibUpdater.exe.
Treat attachments with names evoking official Ukrainian documents — especially terms like "rozporyadjennya" (order/directive) — as objects requiring additional verification regardless of apparent extension.

Why This Campaign Redefines the Defense Perimeter

The UAC-0099/Notepad++ campaign fits a broader strategic pattern documented by the U.S. government: Russia-aligned cyber threats use Ukraine as a proving ground for techniques later extended to NATO and U.S. targets. The quote attributed by The Hacker News in the context of the general pattern — "extensive campaigns against Ukrainian targets, before use against the United States and other NATO allies, outline a growing trend" — provides the geopolitical framework within which to read the technical innovation.

The "unpatchable feature" represents a category of risk that organizations must learn to manage. Not every attack vector is solvable with a patch cycle; some require recognizing that legitimate software, configured legitimately, can be weaponized by actors who control the installation context. Defense shifts from vulnerability management to behavioral control, from update management to verification of the entire distribution stack's integrity.

For teams operating in environments with exposure to the Ukrainian context or its supply chains, the implicit operational recommendation in the dossier is clear: the plugin ecosystem of widely used applications like Notepad++ must be treated as an active attack surface, not as a secondary feature transparent to the user.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references