Back Feeds2.Feedburner

Notepad++ supply chain attack: Researchers reveal details, IoCs, targets

Feeds2.Feedburner •Zeljka Zorz • February 3, 2026

Rapid7 researchers have attributed the recent hijacking of the Notepad++ update mechanism to Lotus Blossom (aka Billbug), a Chinese state- group known for targeting organizations in Southeast Asia for espionage purposes. On Wednesday, Kaspersky researchers shared the insights they’ve gleaned from their own telemetry: the attackers targeted individuals located in Vietnam, El Salvador and Australia; a government organization located in the Philippines; a financial organization located in El Salvador; and a Vietnamese IT service provider. … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

State-Sponsored Hackers Compromise Notepad++ Update Mechanism Notepad++ has been hijacked by state-sponsored hackers, specifically a likely Chinese threat actor. The attackers compromised the software's update mechanism between June and December 2025, allowing them to redirect users to malicious servers by exploiting a flaw in update package validation. 100 sources 60

Extracted Entities

Notepad++ supply chain attack: Researchers reveal details, IoCs, targets

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Countries (4)

Industries (2)