Fake Notepad++ Plugin Used in UAC-0099 Cyberattacks
Russia-linked hacker group UAC-0099 deploys malware via a fake software plugin.
1Attack Initiation
Ukraine's CERT team revealed that Russia-linked UAC-0099 is targeting Windows systems using a fake Notepad++ plugin. The attack begins with phishing emails containing shortened links. When clicked, a malicious ZIP file is downloaded.
2Malware Distribution
The ZIP file contains a VBScript disguised as a PDF. Upon opening, a decoy PDF is shown while 'Evernote.zip' is silently downloaded in the background. This file includes both the legitimate Notepad++ software and a malicious DLL plugin.
3Malicious Code Execution
The DLL plugin (LUNCHPOKE) extracts an encrypted RAR archive containing 'RemoteLibUpdater.exe' and 'InitTest.dll.' These files execute MATCHBOIL.V2, a malicious loader. If launched incorrectly, it triggers a logic that exhausts system resources.
4Targeted Organizations
The attacks primarily target Ukrainian government agencies. CERT-UA recommends keeping software like WinRAR, 7-Zip, and Notepad++ updated. Russia-linked groups exploit such vulnerabilities for data theft and espionage.
5Related Campaigns
The U.S. government warned of a campaign by Russia's Laundry Bear group targeting Zimbra mail servers. A 'half-click' exploit allows malware execution just by viewing an email. This method is more dangerous than traditional phishing.
6Expanding Threat
Proofpoint reported that TA458 is targeting webmail systems via Operation RoundPress. Attacks initially focused on Ukraine are now spreading to NATO allies. Russian groups use Ukraine as both a primary target and a testing ground.
Original article: The Hacker News — Ukrayna'da Sahte Notepad++ Eklentisi ile Siber Saldırı