Loading malware…
LUNCHPOKE is a 64-bit .NET dropper for Windows that masquerades as a Notepad++ plugin. It is used by the Russia-aligned UAC-0099 threat cluster, which overlaps with Earth Sirrush, in campaigns targeting Ukrainian organizations. Documented in July 2026, LUNCHPOKE abuses Notepad++'s normal plugin-loading mechanism and uses DLL proxying to execute malicious code when the editor starts while forwarding legitimate plugin exports. This infection mechanism does not require exploitation of a Notepad++ vulnerability or compromise of its software supply chain.
Delivery begins with phishing emails containing clickable images that lead through shortened links to hosted ZIP archives. These archives contain VBScript files disguised as PDF documents using double extensions and filename padding. Executing the script displays a decoy document, retrieves a package containing legitimate Notepad++ components and the malicious plugin, and launches the editor. LUNCHPOKE then uses bundled WinRAR to extract a password-protected archive into a writable directory, deploying BURNYBEAR and MATCHBOIL.V2. It copies and renames the legitimate Windows task-scheduling utility and creates a scheduled task that launches BURNYBEAR every three minutes. BURNYBEAR subsequently loads MATCHBOIL.V2, enabling follow-on payload delivery.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
LUNCHPOKE, a 64-bit .NET DLL that masquerades as a Notepad++ plugin (NppExport.dll).
LUNCHPOKE, a 64-bit .NET DLL that masquerades as a Notepad++ plugin (NppExport.dll).
The UAC-0099 campaign employs a novel approach by distributing a ZIP archive containing Notepad++ version 8.8.3 alongside a malicious plugin named LunchPoke (NppExport.dll). This plugin is loaded by Notepad++ through its standard mechanism, allowing the attackers to create scheduled tasks and deploy further malware.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection chain typically begins with a phishing email containing an image attachment.
The email contained a cutt[.]ly shortened link redirecting to order.cyberflysystems[.]com.
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
The archive contains a Visual Basic Script (VBS) file...
The archive contains a Visual Basic Script (VBS) file... Once executed, the VBS script downloads a decoy PDF document... along with another archive named “Evernote.zip.”
У згаданому архіві міститься VBS-скрипт із подвійним розширенням... У свою чергу, у разі запуску скрипт забезпечить завантаження файлу-приманки...
As Notepad++ supports the loading of plugin libraries as part of its normal operation, launching the legitimate text editor causes the attacker-controlled “NppExport.dll” file to be loaded automatically.
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
The archive contains a Visual Basic Script (VBS) file that employs a double-extension technique. Although the file appears to the user as a PDF document named “Factory District.pdf,” a long sequence of spaces conceals its actual “.vbs” extension.
Store C&C configuration in .library-ms files (an uncommon file extension that blends with Windows Libraries).
It then creates a copy of schtasks.exe, the legitimate Windows Task Scheduler utility and misleadingly renames it “Background.exe.”
create the directory ” %PUBLIC%\Libraries\fFthY3-Ytrevc3w-ab3\ “... (the name of the directory ” fFthY3-Ytrevc3w-ab3 ” changes)
As Notepad++ supports the loading of plugin libraries as part of its normal operation, launching the legitimate text editor causes the attacker-controlled “NppExport.dll” file to be loaded automatically.
a password-protected RAR archive called updater.rar... uses the bundled WinRAR binary to unpack the password-protected archive.
extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll
The dropper downloads TFU_up.bin ... and saves it to C:\Users\Public\Documents\TFU_up.exe.
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.