Back Cybersecuritynews

Notepad++ Hack Detailed Along With the IoCs and Custom Malware Used

Cybersecuritynews •Guru Baran • February 3, 2026

A sophisticated espionage campaign attributed to the Chinese Advanced Persistent Threat (APT) group Lotus Blossom (also known as Billbug). The threat actors compromised the infrastructure hosting the popular text editor Notepad++ to deliver a custom, previously undocumented backdoor named “Chrysalis”. This campaign, discovered by Rapid7 researcher Ivan Feigl, primarily targets organizations in the government, telecommunications, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

State-Sponsored Hackers Compromise Notepad++ Update Mechanism Notepad++ has been hijacked by state-sponsored hackers, specifically a likely Chinese threat actor. The attackers compromised the software's update mechanism between June and December 2025, allowing them to redirect users to malicious servers by exploiting a flaw in update package validation. 100 sources 60

Extracted Entities

Notepad++ Hack Detailed Along With the IoCs and Custom Malware Used

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Industries (2)

Malware (1)