# Sandworm's Proxies Turned Notepad++ Into a Trojan Horse — and the Developer Says There's Nothing to Fix
When Ukraine's Computer Emergency Response Team published its alert on UAC-0099 this week, the technical details were striking enough on their own: a sophisticated multi-stage malware chain using the world's most popular free text editor as a delivery vehicle. But buried inside CERT-UA's writeup was a quieter dispute that cuts to the heart of modern attack surface management. Notepad++'s developers are disputing the CVE. They say their plugin-loading mechanism is working exactly as designed.
They're not wrong. And that's exactly the problem.
## How the Attack Actually Works
UAC-0099 — a threat cluster CERT-UA has previously linked to providing initial access for Sandworm (APT44) operations — recently changed how it gets a foothold into Ukrainian organizations. The new playbook starts with a ZIP archive delivered via spear-phishing. Inside sits a VBS script disguised as a PDF document, the kind of file a busy government employee opens without much thought.
That script fetches a second archive named Evernote.zip — a brand name designed to feel mundane and non-threatening. What's inside is anything but: a complete, legitimate copy of Notepad++ version 8.8.3, a malicious plugin masquerading as the real NppExport.dll, a password-protected RAR file called updater.rar, and a legitimate WinRAR executable to open it.
The VBS script installs everything into a randomly named directory, launches Notepad++, and lets the application do the rest. Notepad++ loads plugins from its plugin directory automatically. The malicious NppExport.dll — which CERT-UA calls LunchPoke — gets loaded through the exact same mechanism that loads any legitimate plugin. No exploit needed. No privilege escalation. Just the software working as intended.
LunchPoke creates a scheduled task and uses the bundled WinRAR binary to extract updater.rar. Out comes RemoteLibUpdater.exe and InitTest.dll. The executable is BurnyBear, a loader that brings in MatchBoil V2, which CERT-UA describes as a malware loader — the final stage before whatever payload UAC-0099 actually wants to deploy. CERT-UA doesn't say what that is. In ongoing operations against state targets, that silence is usually intentional.
BurnyBear also packs a contingency: if RemoteLibUpdater.exe fails to launch, it pivots to a resource exhaustion attack — hammering the host's RAM and CPU. Burn it down if you can't own it quietly.
## The "Feature" Defense and Why It Doesn't Matter
CVE-2025-56383 describes a DLL hijacking condition in Notepad++ v8.8.3. The Notepad++ team's counterargument is technically sound: plugins are supposed to load DLLs. There's no injection happening. There's no memory corruption. An attacker dropping a DLL into the plugin folder and having it execute is, from the software's perspective, normal operation.
This mirrors arguments we've seen before. Microsoft spent years defending Outlook's automatic NTLM authentication behavior as "by design" before finally addressing it. Office macros were a feature, not a bug, right up until they became the dominant malware delivery vector of an entire decade. The pattern is consistent: security researchers identify a feature-turned-attack-vector, the vendor disputes the framing, real attacks accelerate, and eventually something changes — usually after enough damage has been done.
The attackers do not care about the CVE dispute. They care that dropping a DLL into Notepad++'s plugin directory causes it to execute automatically without any additional elevation or exploitation. Whether that's a vulnerability or a feature is a definitional argument. The attack surface is real either way.
CERT-UA's mitigation advice is practical regardless of the semantics: update Notepad++ to version 8.9.7, WinRAR to 7.23, and 7-Zip to 26.02. The updated Notepad++ version reportedly addresses or mitigates the plugin-loading concern, whatever the official classification.
## What Defenders Should Be Watching
The operational sophistication here goes beyond a clever lure. Several layers deserve attention:
The fallback mechanism — BurnyBear's resource exhaustion failsafe signals that this group treats persistence as non-negotiable. An attack chain that scorches the host rather than fail quietly is one where the operators consider detection an acceptable outcome as long as the primary mission either succeeds or the target is degraded.
Legitimate tools throughout the chain — WinRAR, Notepad++, VBS. Every component has a plausible business reason to exist on a Windows workstation. EDR solutions that flag on behavior rather than binaries will catch this; those relying on signature detection for trusted applications won't.
Scheduled task creation as the persistence anchor — LunchPoke creates the scheduled task early in the chain, before the heavier malware stages load. Monitor scheduled task creation, especially from processes launched via user-space application directories rather than system paths.
The plugin directory as an attack surface — If your organization uses Notepad++, ask whether any non-standard DLLs exist in %APPDATA%\Notepad++\plugins\. Most installations won't have anything there beyond what shipped with the software.
---
## HackWire Analysis
UAC-0099 doesn't attract the same headlines as Sandworm proper, but this campaign is a reminder that the access broker role in state-sponsored operations is doing increasingly sophisticated work. The shift in TTPs — from whatever prior delivery mechanism they used to this multi-stage, evasion-layered chain — reflects an adversary that has studied detection failures and iterated.
What's missing from most coverage of this incident is the broader implication for defensive posture in organizations that still treat application allowlisting as optional overhead. The entire UAC-0099 chain succeeds because trusted, signed binaries — Notepad++, WinRAR — execute attacker-controlled code without triggering anything that looks anomalous from a process-integrity standpoint. A strict application control policy that restricts which DLLs can load in user-space application directories would break this chain before LunchPoke runs a single line.
The timing also matters. Ukraine's infrastructure has been under sustained assault throughout the conflict, and the organizations being targeted here are likely not large enterprise shops with mature SOCs. CERT-UA's alerts serve a constituency of government agencies, contractors, and volunteer organizations running lean security programs against one of the most capable offensive cyber groups on the planet. For that population, "update Notepad++ and monitor scheduled tasks" is genuinely actionable guidance, not a hedge.
The MatchBoil V2 loader is the piece worth tracking. CERT-UA declining to name final payloads in active operations is standard practice, but MatchBoil's evolution from V1 suggests an actively maintained toolchain — not a one-off. Expect this loader to reappear in future CERT-UA disclosures with a different delivery mechanism once this chain gets burned.
Defenders outside Ukraine aren't off the hook. Sandworm and its affiliates have a documented history of letting tools developed for Ukraine-targeting operations leak into broader campaigns. NotPetya started as a Ukraine operation. It's worth having a posture now rather than a post-incident review later.
— HackWire Editorial
---
## Related Coverage