Affected Systems

Organizations in Ukraine using Notepad++ 8.8.3. The attack does not exploit a vulnerability in Notepad++; it abuses legitimate plugin-loading functionality to deploy LunchPoke, BurnyBear, and MatchBoil V2 malware loaders via social engineering (malicious VBS script disguised as PDF).

Exploitation Status

Active campaign observed by Ukraine CERT-UA. Attributed to UAC-0099 threat actor, linked to APT44/Sandworm initial access operations. No vulnerability exploitation; relies on user execution of malicious VBS script.

Business Impact

Compromised systems gain persistent scheduled tasks that load multi-stage malware (LunchPoke, BurnyBear, MatchBoil V2). Final payloads not disclosed but likely enable espionage or further lateral movement. Fallback mechanism triggers resource exhaustion (RAM/CPU) if primary loader fails, causing potential denial of service. Primary risk is initial access for advanced persistent threat operations targeting Ukrainian organizations.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block execution of VBS scripts from email attachments and untrusted sources via Group Policy or endpoint controls
  • Update Notepad++ to version 8.9.7 or later to mitigate potential DLL hijacking risks (CVE-2025-56383 disputed but addressed)
  • Hunt for scheduled tasks created by unknown processes, particularly those launching RemoteLibUpdater.exe or referencing randomly named directories
  • Monitor for unusual Notepad++ plugin loads (NppExport.dll) and WinRAR executions extracting password-protected archives
  • Update WinRAR to version 7.23 and 7-Zip to version 26.02 to close known vulnerabilities exploitable in multi-stage attacks

---

# Geopolitical Context

Geopolitical Context

The campaign attributed to UAC-0099 represents a continuation of sustained cyber operations targeting Ukrainian organizations amid the ongoing conflict. UAC-0099 has previously been assessed as providing initial access for APT44 (Sandworm), a threat group widely attributed to Russia's GRU military intelligence service. This operational relationship suggests the campaign may serve strategic intelligence collection or pre-positioning objectives consistent with Russia's broader information warfare and disruption efforts against Ukraine. The use of legitimate software bundled with malicious plugins reflects an evolution in tradecraft aimed at evading detection in a highly contested cyber environment where Ukrainian defenders have developed significant threat awareness.

State Actor Alignment

UAC-0099 has been linked to providing initial access for APT44 (Sandworm), a threat group widely attributed to Russia's Main Intelligence Directorate (GRU). This operational connection suggests UAC-0099 may function as an access broker or enabler within a broader Russian state-sponsored cyber ecosystem targeting Ukraine. APT44/Sandworm has been sanctioned by the United States, United Kingdom, and European Union for destructive cyber operations, including the 2015 and 2016 attacks on Ukraine's power grid and the 2017 NotPetya campaign. The continued targeting of Ukrainian organizations by this threat cluster aligns with Russia's strategic objectives to degrade Ukrainian state capacity and maintain intelligence access during the ongoing conflict.

Business Impacty pro region

The campaign underscores the persistent cyber threat environment facing Ukraine, where state-aligned actors continue to target government, military, and critical infrastructure organizations. For European allies providing military and economic support to Ukraine, the activity highlights the risk of lateral compromise if Ukrainian partner organizations are breached. The evolution in UAC-0099's tradecraft—moving from direct exploitation to social engineering with legitimate software—may indicate adaptation to improved Ukrainian cyber defenses and could presage similar techniques being deployed against other regional targets. NATO member states in Eastern Europe, particularly those with significant Ukrainian refugee populations or cross-border logistics networks supporting Ukraine, may face elevated risk from similar access operations. The campaign also reinforces the broader pattern of Russia-aligned actors maintaining sustained intelligence collection and pre-positioning capabilities against Ukrainian targets throughout the conflict.

Forecast

If UAC-0099 continues to provide initial access for APT44/Sandworm operations, Ukrainian organizations are likely to face follow-on intrusions involving data exfiltration, destructive attacks, or operational disruption in the coming months. Should Ukrainian defenders successfully mitigate this specific tradecraft, UAC-0099 is likely to adapt further, potentially experimenting with other trusted software packages or supply-chain vectors. If the operational relationship between UAC-0099 and APT44 persists, similar plugin-based or software-bundling techniques may be observed in campaigns targeting other states perceived as adversaries by Russia, particularly in Eastern Europe or the South Caucasus. Organizations in sectors critical to Ukraine's wartime economy—defense industrial base, energy, telecommunications, and government—should anticipate continued targeting and prioritize detection of anomalous plugin loading and scheduled task creation.