Nation-State Actors Exploit Notepad++ Supply Chain
Summary: Between June and December 2025, the state-sponsored group Lotus Blossom compromised the shared hosting provider behind Notepad++'s official infrastructure, intercepting and redirecting traffic to the update server so that selected targets received malicious update manifests instead of legitimate updates. The targets were primarily in Southeast Asia across government, telecommunications and critical infrastructure, and Unit 42 identified two infection chains: a Lua script injection variant delivering Cobalt Strike Beacon, and DLL side-loading that misused a legitimate Bitdefender component (BluetoothService.exe) to load a malicious log.dll and execute the Chrysalis backdoor.
Key Takeaway: The attackers exploited insufficient verification in older versions of the WinGUp updater to hijack a tool that system administrators, network engineers and DevOps personnel run on secure jump boxes - so compromising one utility gave implicit administrative access to core infrastructure without the vendor ever being alerted.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026