The **Computer Emergency Response Team of Ukraine (CERT-UA)** has issued a warning regarding a new attack chain attributed to the threat cluster **UAC-0099**. This group, known for primarily targeting Ukrainian organizations and previously linked to providing initial access for **APT44** (also known as **Sandworm**), has refined its tactics to exploit legitimate software functions rather than vulnerabilities. ### The Deceptive Notepad++ Attack Chain **CERT-UA** observed a shift in **UAC-0099**'s modus operandi. The attack begins with the delivery of a ZIP archive containing a VBS script disguised as a PDF document. When executed, this script retrieves a second compressed file, `Evernote.zip`. This `Evernote.zip` archive is meticulously crafted to contain a full, legitimate copy of **Notepad++** version 8.8.3, a malicious plugin named `NppExport.dll`, a password-protected archive (`updater.rar`), and the legitimate **WinRAR** executable. .jpg) The VBS script then installs this package into a randomly named directory, launches **Notepad++**, and subsequently loads the malicious `NppExport.dll` through the application's standard plugin-loading mechanism. ### LunchPoke and MatchBoil V2 Payload Delivery **CERT-UA** identified `NppExport.dll` as **LunchPoke**, a utility designed to establish persistence. **LunchPoke** creates a scheduled task on Windows and extracts the contents of the `updater.rar` file, which includes `RemoteLibUpdater.exe` and `InitTest.dll`. The executable within the RAR file, `RemoteLibUpdater.exe`, is identified as **BurnyBear**. **BurnyBear** acts as a loader for `InitTest.dll`, which is the **MatchBoil V2** malware loader.  **BurnyBear** also incorporates a fallback mechanism: should `RemoteLibUpdater.exe` fail to launch, it triggers a resource exhaustion attack, overwhelming the host's RAM and CPU. The malware then creates another scheduled task, updates its configuration and command-and-control (C2) address, and uses **WinRAR** to extract additional downloaded programs. While **CERT-UA** did not disclose the final payloads or the specific objectives of this campaign, the sophisticated nature of the delivery mechanism underscores the evolving threat landscape. ### Not a Vulnerability, But a Feature Abuse It's crucial to note that the attackers are not exploiting a vulnerability in **Notepad++** itself. Although **CERT-UA** referenced **CVE-2025-56383**, a purported DLL hijacking flaw in **Notepad++** v8.8.3, the **Notepad++** team has publicly disputed this, asserting that plugin loading is a standard and intended functionality of the application. The attackers are effectively weaponizing this legitimate feature. To mitigate similar attacks, **CERT-UA** recommends that system administrators update **Notepad++** to version 8.9.7, **7-Zip** to version 26.02, and **WinRAR** to version 7.23. While these updates won't prevent the abuse of legitimate plugin loading, they address other known vulnerabilities that attackers might exploit for initial access or other stages of an attack chain.