Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
Summary: CERT-UA attributed a new campaign to the Russia-aligned group UAC-0099, which uses a phishing email with an image attachment that leads through a link shortener and file-sharing service to a ZIP archive containing a VBScript disguised as a PDF. The script shows a decoy PDF while loading a malicious Notepad++ plugin, NppExport.dll (LUNCHPOKE), which sets up a scheduled task running every three minutes to launch a loader, BURNYBEAR, that delivers a modified MATCHBOIL C# loader codenamed MATCHBOIL.V2.
Key Takeaway: The chain hides inside Notepad++, a trusted tool, and persists through a scheduled task that fires every three minutes, so a single click on an image attachment buys the attacker repeated execution. CERT-UA's own guidance is to patch WinRAR, 7-Zip, and Notepad++ - the everyday utilities, not the headline software.
Read the original at The Hacker News ↗
- Mentions
- CVE-2025-66376
- Related
- CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026