UAC-0099 Leverages a Trojanized Notepad++ Plugin to Target Ukraine

Introduction

On July 25, 2026, a sophisticated cyber espionage campaign orchestrated by the Russian APT group UAC-0099, active since at least mid-2022, was publicly disclosed. The attack targets Ukrainian organizations through a novel vector: a malicious plugin for the Notepad++ text editor, distributed via phishing and capable of delivering additional payloads to exfiltrate data or sabotage systems. The multi-stage infection chain leverages legitimate software to evade security controls and maintains aggressive persistence.
Concurrently, a U.S. government advisory warns that the Laundry Bear group (Russia) is conducting a parallel campaign against Zimbra servers, exploiting the CVE-2025-66376 vulnerability to spread the ZimReaper malware.

Technical Analysis

The attack originates from a phishing email containing an image that, via a shortened URL, redirects to a file-sharing service (e.g., EasySend.co). The link triggers the download of a ZIP archive containing a VBS script with a double extension (e.g., Zavodskyi rayon.pdf .vbs).

Once executed, the script downloads:

• a decoy PDF, displayed to the user as a distraction;
• a second archive, Evernote.zip.

Evernote.zip contains a fully functional copy of Notepad++ 8.8.3, the malicious DLL NppExport.dll (tracked as LUNCHPOKE), the encrypted archive updater.rar (password-protected), and a completely legitimate portable WinRAR executable.

When the victim launches Notepad++, the program automatically loads the NppExport.dll plugin without any warning. LUNCHPOKE then uses the bundled WinRAR binary to extract updater.rar and drops two payloads:

• BURNYBEAR (RemoteLibUpdater.exe)
• MATCHBOIL.V2 (InitTest.dll)

To ensure persistence, LUNCHPOKE creates a Windows scheduled task that launches BURNYBEAR every three minutes. BURNYBEAR is a loader that executes MATCHBOIL.V2, a C# component capable of downloading additional malicious modules, exfiltrating information, or providing remote access to the attacker. If BURNYBEAR runs without arguments, it activates a sabotage routine that saturates RAM and CPU to hinder forensic analysis.

The entire chain operates from public directories (%PUBLIC%\Libraries, %PUBLIC%\Wallpapers) and uses trusted tools (WinRAR, Notepad++, system scheduled tasks) to remain as inconspicuous as possible.

Impact

The campaign is primarily aimed at Ukrainian targets: government bodies, critical infrastructure, and civil organizations. MATCHBOIL.V2’s ability to download additional payloads exposes victims to sensitive data exfiltration, prolonged espionage, and potential sabotage actions.
The use of a password-protected archive and a loader with anti-analysis behaviors significantly complicates detection by traditional security systems.
The concurrent offensive by Laundry Bear against Zimbra servers (CVE-2025-66376) broadens the threat surface, also involving Western government and commercial entities that use the mail platform.

Mitigation

To reduce the risk of compromise, it is recommended to:

• Update WinRAR, 7-Zip, and Notepad++ to the latest versions, favoring official channels.
• Treat unexpected emails containing image attachments that point to shortened URLs or file-sharing services with extreme caution.
• Monitor for suspicious scheduled tasks, particularly those with names like \W1n3r-U09oTy-Ap5\Updates, and processes launched from anomalous paths (%PUBLIC%\Libraries, %PUBLIC%\Wallpapers).
• Apply the principle of least privilege, limiting administrative rights to strictly necessary accounts.
• Educate users on recognizing files with double extensions (.pdf .vbs) and disguised attachments.
• Implement endpoint protection solutions capable of detecting DLL side-loading techniques and anomalous process behaviors.

FAQ

1. What is UAC-0099 and why does it target Ukraine?
UAC-0099 is a Russia-aligned APT group, active since at least mid-2022. It specializes in cyber espionage and sabotage campaigns against Ukrainian targets, aligning with Russian strategic interests in the ongoing conflict.

2. How does the malicious plugin infect the system without being detected?
The NppExport.dll DLL is automatically loaded by Notepad++ because the editor recognizes it as a legitimate extension. It then uses the provided WinRAR to extract the real payloads from a password-protected archive and creates a scheduled task to maintain persistence—all while leveraging trusted tools and unsupervised system paths.

3. What are the main indicators of compromise (IOCs)?

• Presence of the scheduled task \W1n3r-U09oTy-Ap5\Updates.
• Processes running from %PUBLIC%\Libraries or %PUBLIC%\Wallpapers.
• Loading of NppExport.dll in a version of Notepad++ not obtained from the official site or with suspicious hashes.
• Network traffic to file-sharing services like EasySend.co, especially when linked to phishing emails.