Loading malware…
Chrysalis is a custom Windows backdoor associated with the China-linked cyberespionage group Lotus Blossom, also known as Billbug, Spring Dragon, and Raspberry Typhoon. It was identified in the targeted Notepad++ supply-chain compromise that operated between June and December 2025. Attackers compromised hosting infrastructure and selectively redirected legitimate update requests to trojanized NSIS installers. The broader campaign targeted government, telecommunications, financial, and IT organizations.
The Chrysalis infection chain uses DLL side-loading through a renamed legitimate Bitdefender executable. A malicious library decrypts and executes an encrypted shellcode payload that loads the backdoor. Its execution chain employs layered encryption and obfuscation, including Microsoft Warbird and custom Windows API hashing. Command-and-control communication uses HTTPS with request structures designed to resemble DeepSeek API traffic.
Chrysalis establishes persistence, collects host information, and supports remote administration through a 16-command interface. Its functionality includes interactive shell access, process execution, file reading and writing, file upload, and self-uninstallation. These capabilities support persistent access, reconnaissance, and data theft. Cobalt Strike Beacon and Metasploit components were also deployed in the wider Notepad++ campaign through separate infection chains.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Lotus Blossom exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor. | Lotus Blossom, a suspected China state-sponsored threat actor, exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rapid7 Labs attributed the Notepad++ supply chain compromise to the China-linked threat group Lotus Blossom ... Their report reveals that the attackers deployed a previously undocumented, sophisticated backdoor dubbed “Chrysalis,” which was delivered via a trojanized NSIS installer named update.exe after the Notepad++ users’ update traffic was selectively redirected.
Threat group KTA529 (also known as Lotus Blossom, Spring Dragon, Billbug and Thrip) compromised Notepad++ hosting infrastructure between June and December 2025, intercepting update traffic to deliver a previously undocumented backdoor named CHRYSALIS.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat actors routinely use this technique, known as brand impersonation or typosquatting, to serve malware, infostealers, or remote access trojans under the cover of a well-known application.
"The attackers intercepted and selectively redirected update requests from certain users to malicious servers"
"as well as working credentials for internal services"
the attack was not a vulnerability in the Notepad++ code itself, but a supply chain compromise of the project’s hosting infrastructure, which allowed attackers to selectively redirect update traffic to serve malicious files to specific targets.
state-sponsored Chinese hackers from the Lotus Blossom group compromised the official Notepad++ update infrastructure and delivered a malicious backdoor called Chrysalis to targeted users.
"traffic tied to WinGUp, which updated the software, 'was occasionally redirected to malicious servers, resulting in the download of compromised executables'"
Insikt Group created Sigma rules to detect update.exe's execution of reconnaissance commands (whoami, tasklist, systeminfo, and netstat -ano) and curl commands for system information exfiltration.
The primary payload is a previously undocumented, feature-rich backdoor dubbed “Chrysalis.” It supports 16 distinct commands, including interactive shell access
Description Lotus Blossom TinyCC shellcode execution simulation. Svchost.exe executed with TinyCC compiler flags (-nostdlib -run) to simulate Chrysalis backdoor's shellcode compilation technique.
...Notepad++ ... intercept or redirect update traffic to download and execute an attacker-controlled installer and lead to arbitrary code execution with the privileges of the user.
"...C:\\Users\\*\\AppData\\Roaming\\Bluetooth\\log.dll,Malicious sideloaded DLL" and "...Adobe\\Scripts\\alien.dll,Malicious DLL"
"as well as working credentials for internal services"
Lotus Blossom BluetoothService persistence test execution. Service created in user AppData directory for persistence.
"as well as working credentials for internal services"
Lotus Blossom BluetoothService persistence test execution. Service created in user AppData directory for persistence.
Attackers used a sophisticated loader that leverages Microsoft Warbird, an undocumented internal Windows code-protection framework. This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary, effectively bypassing many security solutions.
This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary
It supports 16 distinct commands, including interactive shell access, file manipulation, and self-uninstallation to hide its tracks.
"as well as working credentials for internal services"
"...Bluetooth\\Bluetooth,Encrypted shellcode blob (no extension)"
"Detects payload bytes in first 0x490 bytes in clipc.dll Warbird technique... scope = 'Microsoft signed DLL - clipc.dll'"
"...C:\\Users\\*\\AppData\\Roaming\\Bluetooth\\log.dll,Malicious sideloaded DLL" and "...Adobe\\Scripts\\alien.dll,Malicious DLL"
"Find Warbird clipc.dll shellcode loader strings" and YARA rules: "...Shellcode_Loader..." and "...Warbird... shellcode loader"
"Unit 42 noted that the campaign was focused on long-term valuable intelligence, leveraging the adversary-in-the-middle (AitM) capability to dynamically fingerprint incoming update requests and filter only priority targets."
"...ProShow\\1.txt,Recon output (whoami/tasklist)"
"...ProShow\\1.txt,Recon output (whoami/tasklist)"
The blog details a unique “heartbeat” mechanism where the malware exfiltrated system information (via tasklist and systeminfo ) by uploading it to the public file-sharing service temp[.]sh
It supports 16 distinct commands, including interactive shell access, file manipulation, and self-uninstallation to hide its tracks.
"Unit 42 noted that the campaign was focused on long-term valuable intelligence, leveraging the adversary-in-the-middle (AitM) capability to dynamically fingerprint incoming update requests and filter only priority targets."
C2 (Command and Control) traffic designed to mimic DeepSeek API endpoints to blend in with legitimate network traffic.
YARA rule includes domains/paths such as "api.skycloudcenter.com" and URIs like "/api/update/v1", "/api/FileUpload/submit", "/api/getInfo/v1"
The campaign rotated C2 servers across three attack chains to deliver a Metasploit loader, Cobalt Strike Beacon, and a custom backdoor called Chrysalis.
Insikt Group created Sigma rules to detect update.exe's execution of reconnaissance commands (whoami, tasklist, systeminfo, and netstat -ano) and curl commands for system information exfiltration.
the malware exfiltrated system information (via tasklist and systeminfo ) by uploading it to the public file-sharing service temp[.]sh , then passing the resulting URL to the attackers via the User-Agent header of a subsequent request.
"attackers... allowing them to maliciously redirect traffic until Dec. 2, 2025"
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used as the basis for a synthetic intrusion scenario evaluating security LLMs. The scenario models DLL side-loading through BluetoothService.exe loading malicious log.dll, with endpoint alerts, telemetry, and threat intelligence supporting investigation. The evaluation uses a harmless EICAR test hash as a stand-in for the loader; it does not deploy real Chrysalis malware.
A simulated backdoor campaign used in the evaluation framework. It involves DLL side-loading on a Windows host, in which BluetoothService.exe loads a malicious log.dll; the scenario includes investigation of associated execution, DLL-load, C2, and DNS activity.
A backdoor campaign used in the evaluation scenario, involving DLL side-loading on a Windows host where BluetoothService.exe loads a malicious log.dll.
A malicious backdoor delivered via a supply chain compromise of the official Notepad++ update infrastructure to targeted users.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.