UAC-0099's Innovative Use of Notepad++ Plugins in Malware Deployment
In July 2026, the Russia-aligned threat group UAC-0099 initiated a sophisticated phishing campaign targeting Ukrainian organizations. The attack began with emails containing image attachments that, when clicked, redirected victims to download a ZIP archive. This archive included a VBScript disguised as a PDF, which, upon execution, installed a legitimate version of Notepad++ alongside a malicious plugin named LUNCHPOKE. This plugin facilitated the deployment of additional malware components, including BURNYBEAR and MATCHBOIL.V2, establishing persistence and enabling further malicious activities on the compromised systems. This incident underscores the evolving tactics of threat actors who exploit trusted software to deliver malware, bypassing traditional security measures. The use of legitimate applications like Notepad++ as delivery mechanisms highlights the need for heightened vigilance and advanced detection capabilities to identify and mitigate such sophisticated threats.
Kill Chain
