Fake Notepad++ Plugin Used in Ukraine Phish

How the Attack Worked

CERT-UA linked this campaign to a Russia-aligned actor tracked as UAC-0099, targeting Ukrainian organizations, particularly in government and public sector environments. The chain begins with a phishing email carrying an image attachment. Clicking the image leads through a link shortener that redirects to a file-sharing service hosting a ZIP archive. Inside the ZIP is a VBScript file disguised as a PDF document, using a double extension and extra spaces in the filename, such as "Zavodskyi rayon.pdf .vbs", so the file appears to be a harmless document at a glance.

Once opened, the script displays a decoy PDF to keep the victim occupied while it quietly downloads a package containing a full Notepad++ installation bundled with a malicious plugin DLL. That plugin unpacks a password-protected archive using a bundled WinRAR executable and creates a scheduled task to relaunch a loader every three minutes, establishing persistence on the system.

Why It Succeeded

The attack layers several deception techniques rather than relying on one trick. An image attachment feels benign, a link shortener hides the true destination, and a file named to look like a PDF exploits the common habit of trusting document extensions without checking closely. Bundling the malicious plugin with a legitimate, full copy of Notepad++ also adds a layer of camouflage, since the software looks and functions like the real tool.

What to Watch For

• Unexpected emails where an image attachment is the call to action leading to a download
• Links behind shorteners that redirect to file-sharing sites for ZIP downloads
• Filenames with double extensions or unusual spacing before the true extension, such as ".pdf .vbs"
• Scheduled tasks or background processes appearing shortly after opening a downloaded file

Building Resistance

Organizations should treat unexpected image-attachment emails that lead to link-shortener downloads as high risk regardless of how convincing the content looks. Staff training should specifically cover filename tricks like double extensions and excessive spacing, since these are easy to miss visually. CERT-UA also recommends keeping commonly abused tools such as WinRAR, 7-Zip, and Notepad++ updated, since attackers may exploit known vulnerabilities in these tools during later stages of an intrusion. Combining technical controls, such as blocking scheduled task creation from unusual locations, with awareness training focused on this specific delivery chain gives defenders the best chance of catching the attack before persistence is established.

How does the fake Notepad++ plugin attack start?

It begins with a phishing email carrying an image attachment. Clicking the image opens a link shortener that redirects to a file-sharing service hosting a ZIP archive.

What makes the malicious file inside the ZIP hard to spot?

The ZIP contains a VBScript disguised as a PDF using a double extension and extra spaces, for example "Zavodskyi rayon.pdf .vbs", so victims believe they are opening a document.

What happens after the script runs?

The script opens a decoy PDF to distract the victim while downloading a package containing a full Notepad++ install plus a malicious plugin DLL that unpacks a loader and sets up a scheduled task to run it repeatedly.

Why is this malware hard for analysts to investigate?

The loader intentionally exhausts CPU and RAM if run without the correct arguments, which complicates sandboxing and analysis attempts.