A new CERT-UA warning should prompt Windows administrators to take a fresh look at how developer tools, archive utilities, and user-facing plugins are handled inside their environments. The latest activity attributed to UAC-0099 uses a fake Notepad++ plugin as part of a multi-stage infection chain that ultimately delivers MATCHBOIL.V2, a newer version of a loader associated with Russia-aligned cyber operations.

The campaign is notable because it does not rely on a flashy executable with an obvious malware name. Instead, it blends legitimate software, familiar file types, a decoy document, and DLL plugin loading behavior. That combination is exactly why defenders should treat it as a practical endpoint-hardening issue rather than simply another phishing headline.

What CERT-UA Reported

According to reporting summarized by The Hacker News, Ukraine's Computer Emergency Response Team has linked the activity to UAC-0099, a threat cluster active since at least 2022 and previously associated with phishing-led intrusions and exploitation of WinRAR vulnerabilities. Earlier activity connected to the group has involved malware families or tools tracked as LONEPAGE, MATCHBOIL, MATCHWOK, and DRAGSTARE.

In the new campaign, the initial lure is a phishing email containing an image attachment. When the target interacts with the image, the request is redirected through a shortened link and then to a file-sharing service to retrieve a ZIP archive. This staging approach is common in real-world intrusions because it helps attackers vary infrastructure, hide the final payload location, and evade simple email gateway rules that only inspect direct attachment content.

Inside the archive is a Visual Basic Script disguised as a PDF document. If a user launches it, a decoy PDF is displayed while the script quietly retrieves another archive named Evernote.zip. That second archive contains a legitimate copy of Notepad++ version 8.8.3, a malicious plugin DLL named NppExport.dll, a password-protected updater archive, and a legitimate WinRAR executable.

Why the Fake Plugin Matters

Notepad++ is widely used by developers, administrators, analysts, and power users. That makes it attractive for attackers: it is trusted, commonly allowed by application controls, and often installed on systems with access to scripts, credentials, documentation, and operational tooling.

The reported malicious DLL, codenamed LUNCHPOKE, is loaded as a Notepad++ plugin. Its role is to unpack additional components from the protected archive, including RemoteLibUpdater.exe and InitTest.dll, into a target directory. It then establishes persistence by creating a scheduled task that runs RemoteLibUpdater.exe on a scheduled task cadence of every three minutes.

RemoteLibUpdater.exe is identified as BURNYBEAR, a loader that starts InitTest.dll. CERT-UA describes InitTest.dll as a modified version of MATCHBOIL, now tracked as MATCHBOIL.V2. MATCHBOIL is a C#-based loader capable of delivering follow-on payloads, which means the initial compromise should be viewed as an entry point rather than the full extent of attacker capability.

CERT-UA also noted an unusual behavior: if BURNYBEAR is launched incorrectly without required arguments, it can activate resource-exhaustion logic targeting RAM and CPU. For defenders, unexplained spikes in resource usage on systems that recently executed suspicious scripts or unexpected Notepad++ instances may therefore be a useful investigative clue, although it should not be treated as a standalone indicator.

Defensive Priorities for Windows Environments

The most immediate action is to reduce the attack surface around the tools used in this chain. CERT-UA recommends updating WinRAR, 7-Zip, and Notepad++ to current versions. That advice is important because UAC-0099 has previously abused archive-handling weaknesses, and outdated decompression utilities remain a recurring foothold in phishing campaigns.

Organizations should also review whether Notepad++ plugin loading is necessary on managed systems. Where possible, restrict plugin directories to administrator-writeable locations, monitor for newly created DLLs under Notepad++ paths, and alert when Notepad++ is launched from unusual directories such as user profile download folders, temporary extraction paths, or newly created archive staging locations.

Email and web controls should pay close attention to shortened links that redirect to file-sharing services, especially when the email attachment is an image rather than the final payload. Blocking all file-sharing services may not be practical, but high-risk combinations deserve scrutiny: image lure plus URL shortener, script file inside ZIP, password-protected nested archive, or a legitimate application bundled with a suspicious DLL.

Endpoint detection teams should hunt for scheduled tasks with unusually frequent execution intervals, especially every few minutes, that invoke binaries from user-writable directories. Review recent process ancestry where wscript.exe or cscript.exe launches archive tools, Notepad++, or unexpected download commands. Security teams should also inspect for files named NppExport.dll, RemoteLibUpdater.exe, InitTest.dll, and updater.rar where those names appear outside known-good software deployment packages.

Practical User Guidance

For end users, the message is straightforward: do not open scripts or archives received through email just because they appear to contain a PDF, image, or productivity-related file. If a supposed document requires extracting a ZIP, running a script, or launching an included application, it should be treated as suspicious and reported.

For IT teams, the bigger lesson is that trusted software can be turned into an execution vehicle when attackers control the surrounding files. Application allowlisting, plugin governance, script restrictions, and archive scanning need to work together. A legitimate Notepad++ binary is not automatically safe if it arrives inside an email-delivered archive with an attacker-supplied plugin.

The campaign reinforces a broader pattern in Russia-aligned intrusion activity: phishing remains effective, but the payload chains are increasingly designed to look like normal administrative or productivity software behavior. Organizations supporting Ukrainian, Eastern European, government, defense, technology, or critical infrastructure operations should treat this as a priority detection and hardening opportunity.

Source: The Hacker News source