# Fake Notepad++ Plugin Used in UAC-0099 Cyberattacks Russia-linked hacker group UAC-0099 deploys malware via a fake software plugin. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-24 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/9f6b9096-e5a2-4644-8072-328659e94737 ## Attack Initiation Ukraine's CERT team revealed that Russia-linked UAC-0099 is targeting Windows systems using a fake Notepad++ plugin. The attack begins with phishing emails containing shortened links. When clicked, a malicious ZIP file is downloaded. ## Malware Distribution The ZIP file contains a VBScript disguised as a PDF. Upon opening, a decoy PDF is shown while 'Evernote.zip' is silently downloaded in the background. This file includes both the legitimate Notepad++ software and a malicious DLL plugin. ## Malicious Code Execution The DLL plugin (LUNCHPOKE) extracts an encrypted RAR archive containing 'RemoteLibUpdater.exe' and 'InitTest.dll.' These files execute MATCHBOIL.V2, a malicious loader. If launched incorrectly, it triggers a logic that exhausts system resources. ## Targeted Organizations The attacks primarily target Ukrainian government agencies. CERT-UA recommends keeping software like WinRAR, 7-Zip, and Notepad++ updated. Russia-linked groups exploit such vulnerabilities for data theft and espionage. ## Related Campaigns The U.S. government warned of a campaign by Russia's Laundry Bear group targeting Zimbra mail servers. A 'half-click' exploit allows malware execution just by viewing an email. This method is more dangerous than traditional phishing. ## Expanding Threat Proofpoint reported that TA458 is targeting webmail systems via Operation RoundPress. Attacks initially focused on Ukraine are now spreading to NATO allies. Russian groups use Ukraine as both a primary target and a testing ground. ## Sources covering this story - https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._