# Russia's UAC-0099 Is Hiding New Malware Inside a Notepad++ Plugin
When defenders think about supply chain compromise, they usually picture poisoned npm packages or tampered build pipelines. UAC-0099 — the Russia-aligned group that's been quietly carving through Ukrainian networks since at least 2022 — just reminded everyone that the attack surface is much simpler than that: it's the tools people already trust and run every day.
CERT-UA issued a warning this week about a new UAC-0099 campaign delivering a malware strain called MATCHBOIL.V2 disguised as a Notepad++ plugin. The group is betting that when someone sees a Notepad++ extension offered in a familiar context, they install it without a second thought. In Ukraine's current operational environment — where IT staff are stretched thin, networks are under constant pressure, and threat fatigue is real — that bet pays off.
## From WinRAR Exploits to Trojanized Plugins
UAC-0099 has been evolving. Earlier campaigns leaned on weaponized WinRAR archives — most likely exploiting CVE-2023-38831, a zero-day in WinRAR's archive handling that was being actively abused by multiple Russian and Chinese APT groups through late 2023. That vulnerability allowed attackers to embed malicious executables inside seemingly legitimate ZIP files, and it worked well enough that it was a favorite across several threat clusters simultaneously.
Switching to a fake Notepad++ plugin is a meaningful tactical shift. It moves the group away from exploiting a patched (and now widely remediated) vulnerability toward a social engineering model that doesn't depend on the target running outdated software. A plugin doesn't need a CVE. It needs a convincing filename and a moment of inattention.
Notepad++ is not a random choice. It's one of the most widely installed utilities across developer, analyst, and IT administrator workstations — particularly in technical and government environments of the kind UAC-0099 tends to target. Its plugin manager downloads extensions from a trusted ecosystem, but it can also load plugins from local paths. That local-load capability is what makes it attractive to attackers: drop the right DLL in the right directory and Notepad++ will execute it the next time it opens.
## What MATCHBOIL.V2 Actually Tells Us
The version designation matters. "V2" signals that CERT-UA has already tracked an earlier MATCHBOIL variant — this is an iteration, not a debut. Updated malware naming typically means the threat actor modified the payload to evade signatures that caught the original, changed the command-and-control infrastructure, or expanded capabilities based on what worked in earlier intrusions. All three are consistent with how UAC-0099 has operated historically.
Ukraine's CERT has been unusually good at naming and attributing tooling from Russia-aligned groups — they've given defenders genuine signal on UAC clusters rather than just lumping activity into vague APT buckets. The fact that they're tracking MATCHBOIL across versions suggests they've seen it in the wild, recovered samples, and have enough telemetry to call this a deliberate evolution rather than a one-off.
The Windows-specific targeting is expected. Ukraine's government and defense-adjacent networks run Windows. The campaign's use of what amounts to a user-space plugin means the malware likely doesn't need kernel-level access to do its damage — it runs under the user account of whoever installed the fake plugin, which, in many organizations, is already more than enough.
## The Broader Playbook: Tool Trust as an Attack Surface
UAC-0099's plugin gambit fits a pattern that predates this campaign significantly. Threat actors have trojanized developer tools before — the 3CX supply chain attack in 2023 started with a compromised trading application, XZ Utils nearly became a backdoor baked into Linux distributions, and countless npm and PyPI packages have been seeded with credential stealers targeting developers specifically.
What makes plugins particularly dangerous compared to standalone malware is their legitimacy veneer. Security tooling that flags unknown executables will often ignore DLLs loaded by a trusted application like Notepad++. Endpoint detection that monitors for suspicious process behavior may not scrutinize text editor plugins with the same intensity it applies to a new binary dropped in a temp directory. The attacker is intentionally hiding inside the host's own definition of "normal."
This also sidesteps common phishing-detection signals. There's no weaponized Office document here, no macro prompt, no suspicious attachment extension. If the plugin is delivered through a convincing internal-looking channel — a shared file, a fake internal tool recommendation, an internal helpdesk ticket — standard email security controls won't catch it at the perimeter.
## What Defenders Should Do Right Now
The mitigation surface here is actually tractable, which is worth saying plainly:
For Ukrainian government and defense-adjacent organizations specifically, CERT-UA's advisory should be treated as a direct indicator — share the MATCHBOIL.V2 signatures with your security operations team and hunt for them actively rather than waiting for an alert.
---
## HackWire Analysis
The most underreported angle in this story is what it says about the maturation of UAC-0099 as a threat actor. Groups that are still relying on simple spearphishing or known CVE exploitation are, in a sense, still playing defense — they're borrowing from a shared playbook. A group that builds a custom malware lineage (MATCHBOIL → MATCHBOIL.V2), tracks what gets burned, and pivots to a new delivery mechanism is doing iterative threat actor development. That's a different category of adversary.
Russia's war in Ukraine has functioned as a live laboratory for Russian offensive cyber operations for four years now. UAC-0099 is one of several clusters that CERT-UA has documented systematically evolving their tooling in response to Ukrainian defenses getting better. The shift from WinRAR exploitation to plugin abuse is exactly the kind of adaptation you'd expect from an actor that noticed their previous technique getting detected and decided to fix it.
What's missing from most coverage of this campaign is the organizational pressure context. Ukrainian IT and security teams are not operating in a stable peacetime environment. They're defending critical infrastructure while dealing with physical infrastructure disruption, staff turnover, and near-constant pressure across multiple fronts simultaneously. Campaigns like this are calibrated to exploit exactly those conditions — not because the malware is especially sophisticated, but because the defender's attention is already stretched past capacity. The real weapon here isn't MATCHBOIL.V2. It's timing.
Western organizations with Ukrainian supply chain connections or contractors should treat this advisory as relevant to their own environments, not just something happening overseas.
— HackWire Editorial
---
## Related Coverage