UAC-0099 Uses Malicious Notepad++ Plugin to Deploy Malware in Ukraine
Summary
CERT-UA attributes a malware campaign targeting Ukrainian organizations to UAC-0099. A disguised script installs Notepad++ with the LunchPoke plugin, which creates scheduled tasks and deploys further loaders. CERT-UA recommends updating Notepad++, 7-Zip, and WinRAR.
Key points
- CERT-UA attributes the campaign targeting organizations in Ukraine to UAC-0099.
- A ZIP archive is delivered with a VBS script disguised as a PDF; running it retrieves another archive containing Notepad++ and malicious components.
- The script installs the package in a randomly named directory, then Notepad++ loads the malicious NppExport.dll plugin, identified as LunchPoke.
- LunchPoke creates a Windows scheduled task and extracts additional components, including BurnyBear, a loader for the MatchBoil V2 malware loader.
- BurnyBear has a fallback that can trigger resource exhaustion targeting the host’s RAM and CPU if RemoteLibUpdater.exe fails to launch.
- CERT-UA did not identify the final payloads, campaign purpose, or targeted organizations. It advises updating Notepad++, 7-Zip, and WinRAR.
- The article says the campaign did not exploit a software vulnerability or supply-chain compromise; CVE-2025-56383 is mentioned as disputed by the Notepad++ team.
Article Details
- Attack Vectors
- UAC-0099 delivers a ZIP archive containing a VBS script disguised as a PDF; when launched, the script retrieves Evernote.zip.
- The VBS script installs legitimate Notepad++ files and the malicious NppExport.dll plugin in a randomly named directory, then launches Notepad++ to load the plugin.
- LunchPoke creates a Windows scheduled task and extracts additional components from a password-protected RAR archive.
- BurnyBear loads MatchBoil V2 from a DLL and has a fallback that causes resource exhaustion targeting the host's RAM and CPU.
- The later component creates another scheduled task, updates its configuration and C2 address, and uses WinRAR to extract downloaded programs.
- Defensive Notes
- CERT-UA advises administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23.
- The article says the attacks did not exploit a software vulnerability or a Notepad++ supply-chain compromise.
- CERT-UA did not identify the final payloads or targeted organizations in the observed attacks.
MITRE ATT&CK
T1036 · MasqueradingThe VBS script is disguised as a PDF document.T1053.005 · Scheduled TaskLunchPoke and a later component create scheduled tasks on Windows.T1059.005 · Visual BasicA VBS script disguised as a PDF launches the attack chain and retrieves Evernote.zip.T1105 · Ingress Tool TransferThe script retrieves Evernote.zip, and a later component extracts downloaded programs.T1499.001 · OS Exhaustion FloodBurnyBear's fallback triggers resource exhaustion targeting the host's RAM and CPU.
CVE
Threat Actors
SandwormThe article identifies Sandworm as another name for APT44, which it says carried out attacks for which UAC-0099 was previously linked to providing initial access.SANDWORM RELICThe article says UAC-0099 has previously been linked to providing initial access for attacks carried out by APT44; it identifies Sandworm as another name for APT44.UAC-0099CERT-UA attributes the campaign targeting organizations in Ukraine to UAC-0099; the cluster reportedly delivers the archive and malware components described in the article.
Malware
BurnyBearThe executable in the RAR file is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader.LunchPokeUkraine’s CERT has identified a campaign by UAC-0099 that distributes a ZIP archive containing legitimate Notepad++ components alongside a malicious plugin, LunchPoke, to gain persistence and deploy additional tooling.MatchBoil V2The executable in the RAR file is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader.
Products
7-ZipThe activity uses disguised files and scheduled tasks rather than a software vulnerability or supply-chain compromise, and CERT-UA recommends updating Notepad++, 7-Zip, and WinRAR to reduce risk.Notepad++Ukraine’s CERT has identified a campaign by UAC-0099 that distributes a ZIP archive containing legitimate Notepad++ components alongside a malicious plugin, LunchPoke, to gain persistence and deploy additional tooling.WinRARThe activity uses disguised files and scheduled tasks rather than a software vulnerability or supply-chain compromise, and CERT-UA recommends updating Notepad++, 7-Zip, and WinRAR to reduce risk.