UAC-0099 Targets Ukrainian Organizations with Fake Notepad++ Plugin
Russia-linked hacker group employs new malware delivery method in ongoing cyber campaign.
1Emergence of a New Threat
The Russia-aligned UAC-0099 hacker group has developed a novel attack method targeting Ukrainian organizations. This time, they're distributing malware through a fake Notepad++ plugin. The attack chain displays a legitimate PDF to victims while silently installing malicious software in the background, making the compromise less noticeable.
2Complex Attack Chain
The attack begins with a phishing email containing an image attachment. Shortened links redirect victims to file-sharing sites. When the VBScript file in the ZIP archive executes, it both opens a benign-looking PDF and downloads malware in the background. This dual approach helps avoid raising suspicion among targets.
3Notepad++ Exploitation
Attackers distribute a complete copy of the popular Notepad++ text editor bundled with a malicious DLL plugin. While victims believe they're using a normal text editor, the LUNCHPOKE malware gets installed on their systems. This malware unpacks a password-protected archive to initiate subsequent attack stages.
4Advanced Anti-Analysis Techniques
The BURNYBEAR loader includes sophisticated defense mechanisms - it consumes computer resources when run with incorrect arguments to hinder analysis. Additionally, it creates scheduled tasks that run every three minutes to maintain persistence. These techniques significantly complicate security researchers' analysis efforts.
5Connection to Other Threats
This UAC-0099 campaign coincides with attacks by another Russia-linked group called Laundry Bear targeting Zimbra email servers. Both groups conduct cyber espionage against Western organizations, potentially indicating a coordinated wave of cyber attacks with geopolitical motivations behind them.
6Recommended Protective Measures
CERT-UA recommends updating software like WinRAR, 7-Zip, and Notepad++ to their latest versions. Organizations should exercise caution with unexpected email attachments and provide regular cybersecurity training to employees. These sophisticated attacks underscore the critical importance of maintaining basic security hygiene.
Original article: Security Affairs — UAC-0099 Sahte Notepad++ Eklentisiyle Ukrayna Hedef Alıyor