Hackers Weaponize Notepad++ Plugins to Silently Infect Windows Systems

Gbhackers •Divya • July 24, 2026

CERT-UA has issued a warning regarding the UAC-0099 threat cluster, which has revised its malware delivery method by exploiting the legitimate Notepad++ application to load a malicious DLL disguised as a plugin. This campaign, observed since mid-summer 2026, introduces two newly identified tools, LUNCHPOKE and BURNYBEAR, along with an updated MATCHBOIL.V2 loader. This activity highlights […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UAC-0099 Exploits Notepad++ to Distribute Malware in Ukraine Ukrainian CERT has identified a cyber campaign attributed to the UAC-0099 threat cluster, which targets organizations in Ukraine using the legitimate Notepad++ application to distribute malware. The attackers deliver a ZIP archive containing Notepad++ version 8.8.3 and a malicious plugin named LunchPoke (NppExport.dll). This plugin is loaded through Notepad++'s standard mechanism, allowing the creation of scheduled tasks and deployment of further malware. The initial infection vector involves a VBS script disguised as a PDF that downloads additional archives. The campaign has been linked to the APT44 (Sandworm) group and does not exploit any vulnerabilities in Notepad++. CERT-UA recommends updating Notepad++, 7-Zip, and WinRAR to their latest versions to mitigate risks. The final payloads and specific targets of the attacks remain undisclosed. 8 sources 77

Extracted Entities

Hackers Weaponize Notepad++ Plugins to Silently Infect Windows Systems

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)