Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
CERT-UA identified a new campaign by Russia-aligned group UAC-0099 using a fake Notepad++ plugin to deliver MATCHBOIL.V2 malware via a multi-stage phishing attack. The attack chain involves a VBScript masquerading as a PDF, which silently downloads a ZIP archive containing legitimate Notepad++ and a malicious DLL (LUNCHPOKE) that unpacks the final payload. MATCHBOIL.V2 is a modified C# loader delivered by BURNYBEAR, designed to execute secondary payloads or exhaust system resources if launched i
Analysis
TL;DR
- CERT-UA identified a new campaign by Russia-aligned group UAC-0099 using a fake Notepad++ plugin to deliver MATCHBOIL.V2 malware via a multi-stage phishing attack.
- The attack chain involves a VBScript masquerading as a PDF, which silently downloads a ZIP archive containing legitimate Notepad++ and a malicious DLL (LUNCHPOKE) that unpacks the final payload.
- MATCHBOIL.V2 is a modified C# loader delivered by BURNYBEAR, designed to execute secondary payloads or exhaust system resources if launched incorrectly.
- Concurrently, Russian-linked actors Laundry Bear (TA488) and TA458 are exploiting webmail vulnerabilities (CVE-2025-66376, CVE-2025-49113) for espionage, shifting from data theft to persistent backdoor installation.
- These campaigns highlight a strategic trend of Russian threat groups targeting Ukrainian infrastructure first as a testing ground before deploying techniques against Western government and commercial entities.
Why It Matters
This article underscores the evolving sophistication of Russian-aligned cyber espionage groups, specifically their shift toward "view-based" exploits and supply-chain-style attacks using trusted software like Notepad++. For AI practitioners and security researchers, it highlights the critical importance of monitoring not just traditional malware vectors but also the abuse of legitimate development tools and webmail platforms for persistent access. Understanding these attribution patterns and technical evolutions is essential for developing robust detection models and defensive strategies against state-sponsored threats.
Technical Details
- UAC-0099 Campaign: Uses phishing emails with image attachments leading to link shorteners and file-sharing services. The initial VBScript decoy displays a fake PDF while downloading "Evernote.zip," which contains Notepad++ 8.8.3, a malicious DLL ("NppExport.dll"/LUNCHPOKE), and a password-protected RAR archive.
- Malware Delivery Chain: LUNCHPOKE extracts the RAR archive to load "RemoteLibUpdater.exe" (BURNYBEAR) and "InitTest.dll" (MATCHBOIL.V2). Persistence is established via a scheduled task running every three minutes.
- MATCHBOIL.V2: A modified C# loader capable of delivering secondary payloads. If executed without arguments, BURNYBEAR activates a logic branch designed to exhaust RAM and CPU resources.
- Laundry Bear (TA488): Exploits CVE-2025-66376 in Zimbra webmail via a "half-click" exploit, requiring only email viewing to deliver ZimReaper JavaScript for data harvesting.
- Operation RoundPress (TA458): Targets multiple webmail platforms (Zimbra, Kerio, SOGo, etc.) using zero-days like CVE-2025-49113. The group has transitioned from stealing components to installing interactive backdoors (SpyPress) for long-term persistence, primarily targeting Ukrainian and Eastern European entities.
Industry Insight
- Supply Chain Trust Risks: Attackers are increasingly abusing trusted, widely used software (Notepad++, WinRAR) as delivery mechanisms. Security teams should implement strict application whitelisting and monitor for unusual behavior from known legitimate applications loading unexpected DLLs.
- Webmail Vulnerability Management: The shift toward view-based exploits in webmail clients (Zimbra, Roundcube) means traditional user training on "not clicking links" is insufficient. Organizations must prioritize patching webmail servers and implementing sandboxing or content inspection for incoming emails.
- Geopolitical Targeting Patterns: The pattern of Russian groups testing techniques on Ukrainian targets before expanding globally suggests that monitoring activity in Eastern Europe can provide early warning indicators for broader campaigns affecting Western organizations.
Disclaimer: The above content is generated by AI and is for reference only.