Russia-Aligned Hackers Turn Notepad++ Into Stealth Malware Loader, Exposing Developer Supply-Chain Risk
A malicious Notepad++ plugin is being used to turn the widely used text editor into a malware delivery platform, with Ukraine’s CERT linking the campaign to Russia-aligned group UAC-0099. The plugin establishes persistence and deploys a payload dubbed MATCHBOIL.V2, opening the door to follow-on intrusions. The piece explains who is at risk, how a single compromised plugin can turn everyday coding tools into listening posts, and what this says about the next phase of Russian cyber operations.
One of the world’s most familiar text editors is being repurposed as a stealth weapon in Russia’s cyber toolkit. A newly exposed campaign uses a malicious Notepad++ plugin to convert the popular code and text editor into a malware loader, giving attackers a foothold on developers’ and administrators’ machines while hiding in plain sight.
Ukraine’s computer emergency response team, CERT-UA, has linked the operation to UAC-0099, a Russia-aligned threat group. According to technical disclosures, the bogus plugin hooks into Notepad++’s extension system to establish persistence on infected systems and then deploys a payload known as MATCHBOIL.V2 for follow-on malware installation and control. By targeting a legitimate, widely trusted application rather than abusing obvious phishing lures, the attackers increase their odds of slipping past both human suspicion and some security filters.
The risk goes well beyond individual users. Notepad++ is a staple tool for developers, system administrators and power users in enterprises and governments — people who often have elevated privileges or access to sensitive code and configuration files. Turning their everyday editor into a backdoor creates the potential for espionage, data theft or even sabotage if attackers can hop from compromised workstations into critical networks.
For organizations in Ukraine and other countries targeted by Russia-linked operators, the move fits a broader pattern of supply-chain and tool-chain attacks. Rather than battering down the front door, groups like UAC-0099 increasingly look for ways to poison the well: code repositories, plugins, libraries and updates that users voluntarily install and trust. If a malicious Notepad++ plugin can be smuggled into that ecosystem — whether via hijacked distribution channels, trojanized downloads or social engineering — it effectively turns the convenience of extensible software into an attack surface.
The MATCHBOIL.V2 component is described as a loader, designed to pull in further malware once the initial infection is in place. That modular design gives attackers flexibility: they can deploy credential stealers, keyloggers, remote access tools or destructive payloads as needed, and swap them out over time to evade detection. It also means a compromise may not be obvious; the initial infection could sit relatively quietly until operators decide to activate more aggressive capabilities.
Strategically, leveraging a ubiquitous tool like Notepad++ aligns with Russia’s broader cyber approach against Ukraine and sympathetic targets elsewhere: low-cost, scalable operations that can harvest intelligence, disrupt services or erode trust without always crossing into overt cyberwarfare. For states and companies aligned with Kyiv, it is a reminder that technical solidarity — sharing tools, code and practices — must be matched by rigorous security around those same tools.
For individual developers and small firms, the episode underscores an uncomfortable reality: in an era of geopolitical cyber conflict, your favorite text editor or plugin is no longer just a productivity aid — it can be a geopolitical vector if adversaries can compromise its supply chain.
Signs to watch include whether additional security firms corroborate the link to UAC-0099, whether similar malicious plugins begin to surface for other widely used editors and IDEs, and how quickly Notepad++ maintainers and software repositories move to audit and lock down their extension ecosystems. Any evidence that the same tactic is being deployed beyond Ukraine, particularly in NATO countries or critical industries, would signal that this is not a one-off operation but a template for a wider campaign.
Sources
- OSINT