Ukraine's CERT Says UAC-0099 Hid Malware in Fake Notepad++ Plugin

Overview

• CERT-UA publicly disclosed the campaign in late July 2026 and attributed the activity to UAC-0099, a Russia-aligned cluster long active against Ukrainian targets.
• The attackers used phishing that led victims to a ZIP holding a VBScript disguised as a PDF which then downloaded an archive containing Notepad++ 8.8.3, a malicious plugin named NppExport.dll, a passworded updater.rar, and a bundled WinRAR executable.
• When launched, Notepad++ loads the fake plugin (codenamed LUNCHPOKE) which unpacks updater.rar to a specific folder and creates a scheduled task that runs RemoteLibUpdater.exe every three minutes to ensure persistence.
• RemoteLibUpdater.exe (tracked as BURNYBEAR) loads InitTest.dll, a modified MATCHBOIL loader now called MATCHBOIL.V2, and BURNYBEAR contains a fallback routine that can exhaust system resources if run without expected arguments.
• CERT-UA advises updating Notepad++, 7-Zip and WinRAR to patched versions, inspecting plugin folders, blocking execution of suspicious VBS attachments, and monitoring for unusual scheduled tasks while the Notepad++ team disputes that an exploitable DLL hijack was used.