The Computer Emergency Response Team of Ukraine (CERT-UA) has identified a new cyber espionage campaign involving a malicious program disguised as a Notepad++ plugin, targeting Windows systems. This activity is attributed to the threat group UAC-0099, a Russia-aligned entity active since at least mid-2022.
UAC-0099 has previously exploited vulnerabilities in WinRAR software to deliver malware strains like LONEPAGE and has used phishing emails to deploy other malicious payloads such as MATCHBOIL, MATCHWOK, and DRAGSTARE.
In the latest campaign, observed earlier this summer, the attack begins with a phishing email containing an image attachment. When clicked, the image redirects the user via a shortened URL to a file-sharing service like EasySend[.]co, from which a ZIP archive is downloaded.
This ZIP file contains a Visual Basic Script (VBScript) masquerading as a PDF document. Executing this script displays a decoy PDF to the user while simultaneously downloading another archive named “Evernote.zip.” This second archive includes:
- A complete copy of Notepad++ version 8.8.3
- A malicious DLL plugin named “NppExport.dll”
- A password-protected archive titled “updater.rar”
- A legitimate WinRAR executable
The VBScript extracts these contents and launches Notepad++, which loads the malicious “NppExport.dll.” This DLL, referred to as LUNCHPOKE, unpacks the “updater.rar” archive containing “RemoteLibUpdater.exe” and “InitTest.dll.” It then establishes persistence by creating a scheduled task to run “RemoteLibUpdater.exe” every three minutes.
“RemoteLibUpdater.exe,” known as BURNYBEAR, acts as a loader for “InitTest.dll,” a modified version of the MATCHBOIL malware, now dubbed MATCHBOIL.V2. Notably, if “RemoteLibUpdater.exe” is executed without the correct arguments, BURNYBEAR initiates a process designed to exhaust system resources, such as RAM and CPU.
CERT-UA advises organizations to update their WinRAR, 7-Zip, and Notepad++ software to the latest versions to mitigate the risk of exploitation by threat actors.
This development underscores the evolving tactics of cyber espionage groups, particularly those aligned with nation-states. The use of legitimate software as a delivery mechanism for malware highlights the importance of vigilance and regular software updates. Organizations should implement robust security measures, including user education on phishing tactics and the deployment of advanced threat detection systems, to defend against such sophisticated attacks.
