GoKawiilUkraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.
The campaign has been attributed to a threat cluster tracked as UAC-0099, which primarily targets organizations in Ukraine and has previously been linked to providing initial access for attacks carried out by APT44, also known as Sandworm.
The attackers do not exploit any vulnerability or a supply-chain compromise impacting the popular software.
Notepad++ attack chain
CERT-UA observed that UAC-0099 changed their modus operandi recently and now delivers a ZIP archive with a VBS script disguised as a PDF document. When launched, the PDF retrieves another compressed file named Evernote.zip.
The second archive contains a complete copy of the legitimate editor Notepad++ version 8.8.3, a malicious plugin (NppExport.dll), a password-protected archive (updater.rar), and the legitimate WinRAR executable.
Overview of the UAC-0099 attack
Source: CERT-UA
The VBS script installs the package into a randomly named directory, launches Notepad++, and then loads the malicious NppExport.dll via the application’s normal plugin-loading mechanism.
CERT-UA explains that this DLL is LunchPoke, a tool that creates a scheduled task on Windows and extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll.
... continue reading