Fake Notepad++ Plugin Used by UAC-0099 to Deploy MATCHBOIL.V2 Malware: CERT-UA Issues Urgent Warning

How MATCHBOIL.V2 Malware Exploits a Counterfeit Notepad++ Plugin

The latest threat? A fake Notepad++ plugin delivering MATCHBOIL.V2 malware. It's not just a nuisance; it’s a sign of escalating cybercriminal tactics, linked to the Russia-aligned UAC-0099 group. When even trusted software can become a weapon, it’s time for developers and users to take notice. This is no longer a game of cat and mouse; it's a wake-up call for the entire industry.

UAC-0099's focus on trusted software like Notepad++ reflects a growing trend among advanced threat actors to exploit user trust in mainstream applications. By leveraging familiar tools, attackers increase the likelihood of successful compromise, as users are less likely to suspect malicious intent behind legitimate-looking software components. This approach challenges traditional security assumptions and underscores the need for continuous verification, even for widely adopted tools.

Understanding the Tactics Behind the UAC-0099 Attack

The UAC-0099 group is back at it. Famous for their earlier work with WinRAR weaknesses, they've shown they're still a threat. Their latest scheme kicks off with a clever phishing email — it tempts the unsuspecting into downloading a ZIP file. Once unzipped, this file harbors a Visual Basic Script masquerading as a PDF document. Users are easily misled; while they think they're opening a harmless PDF, something else is brewing. That script quietly downloads an additional archive called 'Evernote.zip,' which surprisingly packs Notepad++ version 8.8.3 along with a sinister DLL file named 'NppExport.dll.' As noted by Thehackernews, there's more—this ZIP also hides a password-protected RAR file alongside a genuine WinRAR executable. This layered approach makes detection tricky, allowing the attack to slip by unnoticed while raising the chances of system compromise significantly.

The multi-stage delivery mechanism employed here demonstrates a high degree of operational security and technical sophistication. By embedding both legitimate and malicious files, UAC-0099 increases the complexity of forensic analysis and evades some automated detection tools. This layered approach is increasingly favored by advanced persistent threat groups seeking to maintain stealth and persistence within target environments.

How UAC-0099 Delivers MATCHBOIL.V2 Malware Through Deception

The VBScript in this attack has one goal: extract the 'Evernote.zip' archive and run its contents. It kicks off Notepad++ to load the harmful 'NppExport.dll'. This isn’t just any DLL; it unpacks a RAR file that houses 'RemoteLibUpdater.exe' and 'InitTest.dll'. Interestingly, 'RemoteLibUpdater.exe', which some call BURNYBEAR, acts as a loader for 'InitTest.dll'—a revamped version of the infamous MATCHBOIL malware, now branded as MATCHBOIL.V2. Persistence is key here; a scheduled task ensures that the loader operates every three minutes. So, according to CERT-UA, if 'RemoteLibUpdater.exe' stumbles out of the gate, BURNYBEAR has a backup plan: it kicks in its resource-draining logic, making it even trickier to respond to the incident. All this complexity—layers of loaders and scheduled tasks—underscores an intentional strategy to dodge detection and secure ongoing access.

The use of scheduled tasks for persistence is a hallmark of sophisticated malware operations, as it allows attackers to re-establish footholds even after partial remediation. The fallback mechanism that triggers resource exhaustion if the loader is run incorrectly may be intended to hinder forensic analysis or disrupt incident response efforts, buying attackers additional time within compromised environments.

What This Malware Attack Means for Software Trustworthiness

This attack highlights an urgent issue. Using a well-known tool like Notepad++ to spread malware? That's unsettling, particularly because it undermines user trust in software they’ve always relied on. Relying only on brand recognition for safety — it's simply not sufficient anymore. Now, users must be proactive in checking software authenticity and keeping up with updates. Attackers are, in fact, honing in on the software supply chain, taking advantage of existing trust. Organizations should, therefore, rethink their verification and monitoring strategies, perhaps adopting a more cautious approach to protect their systems.

The erosion of trust in widely used software can have far-reaching effects, potentially leading to slower software adoption and increased operational friction as organizations implement stricter controls. This shift may also prompt software vendors to enhance their plugin ecosystems with stronger authentication and integrity checks, raising the bar for both legitimate developers and attackers.

Is Ukraine the New Testing Ground for Cyber Attacks?

UAC-0099’s focus on Ukrainian users hints at something deeper — perhaps a geopolitical agenda. It’s intriguing, really, to consider why Ukraine becomes the prime target. This trend shows a clear pattern: Russian cyber threat groups seem to test their tactics in Ukraine first before launching them on a global scale. In fact, this is not just a haphazard approach; it's a deliberate strategy aimed at destabilizing the region. There’s a history here, one that highlights how operations in Ukraine provide a blueprint for future assaults on Western nations. Should these techniques prove effective, there's a genuine risk they could be quickly adapted for use on other fronts.

Ukraine's position as a frequent target for advanced cyber operations has made it a bellwether for emerging threat tactics. Security teams outside the region should closely monitor developments in Ukraine, as techniques pioneered there are often exported to other geopolitical theaters, raising the stakes for global cyber defense readiness.

What CERT-UA Advises to Mitigate MATCHBOIL.V2 Threats

CERT-UA has urged organizations to upgrade their WinRAR, 7-Zip, and Notepad++ software without delay. Why? Because exploits are a constant threat, and staying ahead is crucial. By recommending these updates, they spotlight the necessity of adopting a proactive stance on cybersecurity. The history of UAC-0099, which has leveraged WinRAR weaknesses to spread malware such as LONEPAGE, adds weight to this advice. It's clear—if systems aren’t patched promptly, the consequences could be dire. Organizations can’t afford to overlook timely updates and the relevance of user awareness in their defense strategies.

The emphasis on updating compression and editing tools reflects attackers' preference for exploiting common, cross-industry software. Organizations that lag in patch management are at heightened risk, as threat actors often automate the scanning and exploitation of known vulnerabilities soon after public disclosure.

Meanwhile, the U.S. government has uncovered a phishing scheme tied to Laundry Bear, a threat actor with Russian connections. This group has been actively targeting Zimbra mail servers that serve Western government and business entities since at least July 2025, as reported by Thehackernews. The global influence and flexibility of these Russian cyber operatives is quite alarming. But it also highlights why countries must remain alert and collaborate to enhance their security measures.

UAC-0099's Tactics Raise Alarms About Cybersecurity Preparedness

The UAC-0099 attack vector shows a new level of cunning. Using trusted software to deliver attacks? That's an interesting twist. Cybersecurity teams can't just sit back. They need to shift their attention from perimeter defenses that don't hold up anymore; they must beef up internal monitoring and response systems. Embracing zero-trust architectures is key. These architectures operate on the assumption that a breach has already occurred — requiring constant verification of user actions and software processes. As cybercriminals refine their tactics, companies must rethink their security strategies. It's about anticipating potential breaches — and stopping them before they spiral out of control. Proactive security investments? They're more critical now than ever before.

The move toward zero-trust and continuous monitoring is a direct response to the increasing sophistication of threat actors. Organizations that fail to modernize their security architectures risk becoming easy targets for attackers who exploit implicit trust in internal systems and software.

VTechX Take

The emergence of MATCHBOIL.V2 malware via a counterfeit Notepad++ plugin underscores the evolving tactics of the UAC-0099 group, which exploits user trust in familiar software to enhance attack success rates. As a result, organizations will likely intensify their software verification processes to counteract these sophisticated threats, driven by the urgent need to restore confidence in widely used applications. Watch for an increase in software update compliance rates among organizations as they respond to CERT-UA's recommendations.

Why Cybersecurity Experts Warn of Rising Malware Threats

As threat actors keep innovating, the next wave of malware may target even more widely used software, or adopt subtler infiltration methods. Will defenders be able to anticipate and counter these new approaches before the fallout spreads further?

Frequently Asked Questions

What is MATCHBOIL.V2 malware?

MATCHBOIL.V2 is a modified version of the MATCHBOIL malware, which is a C#-based loader capable of delivering secondary payloads.

How does UAC-0099 deliver the MATCHBOIL.V2 malware?

UAC-0099 delivers MATCHBOIL.V2 malware through a multi-stage attack that begins with a phishing email, leading to the download of a ZIP file containing a Visual Basic Script that extracts and runs malicious components.

Why is the use of a fake Notepad++ plugin significant?

The use of a fake Notepad++ plugin is significant because it reflects a growing trend among advanced threat actors to exploit user trust in widely adopted software, making it easier to compromise systems.

What actions does CERT-UA recommend to prevent attacks like this?

CERT-UA recommends that organizations update their WinRAR, 7-Zip, and Notepad++ software to the latest versions to prevent threat actors from exploiting known vulnerabilities.