Notepad++ Attack Breakdown Reveals Sophisticated Malware and Actionable IoCs

Gbhackers •Divya • February 3, 2026

A complex espionage campaign attributed to Chinese APT group Lotus Blossom, active since 2009. The investigation uncovered a sophisticated compromise of Notepad++ distribution infrastructure that delivered Chrysalis, a previously undocumented custom backdoor with extensive remote access capabilities. The attack chain began at IP address 95.179.213.0, where execution of notepad++.exe and GUP.exe preceded download of a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

State-Sponsored Hackers Compromise Notepad++ Update Mechanism Notepad++ has been hijacked by state-sponsored hackers, specifically a likely Chinese threat actor. The attackers compromised the software's update mechanism between June and December 2025, allowing them to redirect users to malicious servers by exploiting a flaw in update package validation. 100 sources 60

Extracted Entities

Notepad++ Attack Breakdown Reveals Sophisticated Malware and Actionable IoCs

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

IP Addresses (1)

Malware (1)