The Computer Emergency Response Team of Ukraine (**CERT-UA**) has issued a warning regarding a new campaign deploying a malicious program disguised as a **Notepad++** plugin to compromise Windows systems.  ### UAC-0099's Latest Attack Vector **CERT-UA** attributes this activity to the threat cluster **UAC-0099**, a Russia-aligned group previously known for exploiting **WinRAR** vulnerabilities to deliver **LONEPAGE** malware. Other attacks by this adversary, active since mid-2022, have involved phishing emails to deploy **MATCHBOIL**, **MATCHWOK**, and **DRAGSTARE**. The current attack chain, observed earlier this summer, begins with a phishing email containing an image attachment. Clicking this image redirects to a URL concealed by a link shortener, ultimately leading to a file-sharing service like EasySend[.]co to retrieve a ZIP archive. ### Multi-Stage Infection Process The ZIP file contains a Visual Basic Script (VBScript) masquerading as a PDF document. Executing this VBScript displays a decoy PDF to the victim while silently downloading a second archive, "Evernote.zip." This archive is packed with several components: * A legitimate copy of **Notepad++** version 8.8.3 * A malicious DLL plugin, "NppExport.dll" * A password-protected archive, "updater.rar" * The legitimate **WinRAR** executable, "winrar.exe" The VBScript's primary function is to extract these contents and launch **Notepad++**, which then loads the malicious "NppExport.dll." This DLL, codenamed **LUNCHPOKE**, unpacks the RAR archive containing "RemoteLibUpdater.exe" and "InitTest.dll" into a specific directory. It then establishes persistence via a scheduled task to run "RemoteLibUpdater.exe" every three minutes. The "RemoteLibUpdater.exe" binary, known as **BURNYBEAR**, acts as a loader for "InitTest.dll." This DLL is a modified version of **MATCHBOIL**, a C#-based loader, now dubbed **MATCHBOIL.V2**, capable of delivering secondary payloads. **CERT-UA** notes that if "RemoteLibUpdater.exe" is launched without arguments, **BURNYBEAR** instead exhausts system resources (RAM and processor). **CERT-UA** recommends updating **WinRAR**, **7-Zip**, and **Notepad++** to their latest versions to mitigate potential exploitation.  ### 'Half-Click' Exploits Target Webmail Servers These disclosures coincide with warnings from the U.S. government regarding a phishing campaign orchestrated by the Russia-linked threat actor **Laundry Bear** (also known as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard). This group has been targeting **Zimbra** mail servers of Western government and commercial organizations since at least July 2025. The campaign employs a novel "half-click" exploit, abusing **CVE-2025-66376**, to deliver malicious JavaScript dubbed **ZimReaper**. This malware is designed to harvest email communications and other sensitive data. Unlike traditional phishing, this exploit only requires a user to view a malicious email within a vulnerable webmail service. The covert and persistent nature of this activity strongly suggests Russian government-backed espionage, with Ukraine often serving as a testing ground for these techniques. ### TA458 and Operation RoundPress Expansion Further reports from **Proofpoint** highlight the continued webmail targeting by the Russian threat actor **TA458** (distinct from **APT28**), utilizing similar half-click cross-site scripting (XSS) exploits as part of **Operation RoundPress**. Initially exposed by **ESET** in May 2025, this campaign has expanded its scope to include **Kerio Webmail** and **SOGo Webmail**, in addition to **Zimbra**, **mDaemon**, and **Roundcube**. In March 2026, the group reportedly exploited zero-day vulnerabilities in **Kerio** and **SOGo** webmail platforms (**CVE-2026-8496**), which was subsequently patched in **SOGo** version 5.12.8. For **Kerio**, no CVE was issued due to the product's outdated status. Since July 2025, **TA458** has shifted its focus from pure data stealing to incorporating interactive backdoor mechanisms into its **Roundcube** variant of **SpyPress**. This enables long-term access to instances. **SpyPress** leverages a second **Roundcube** exploit (**CVE-2025-49113**) that abuses the file upload handler to trigger unsafe PHP deserialization, leading to arbitrary code execution and the installation of multiple backdoors for persistent access. **Proofpoint** describes **TA458** as a likely Russian military intelligence operation primarily targeting Ukrainian government and Eastern European military and government entities, with occasional incursions into chemical, telecommunications, and technology firms. The **SpyPress** malware is continuously modified based on the targeted mail server.