Loading story…
Rapid7 Labs and the Rapid7 MDR team reported a targeted espionage campaign attributed to the Chinese APT group Lotus Blossom, in which attackers compromised infrastructure used to distribute Notepad++ and leveraged it to deliver a previously undocumented backdoor dubbed Chrysalis. Victimology described in the reporting includes government, telecom, aviation, media, and other critical infrastructure organizations, with activity historically concentrated in Southeast Asia and later observed in Central America. The intrusion chain observed on affected hosts included execution of notepad++.exe and GUP.exe followed by a suspicious update.exe downloaded from 95.179.213.0, consistent with abuse of the Notepad++ distribution channel; Rapid7 noted that while prior public reporting referenced plugin replacement and updater-related mechanisms, their forensics did not confirm a specific sub-mechanism beyond the observed execution sequence.
Technical analysis described NSIS installer-based delivery, DLL sideloading, and multiple custom loaders, including a notable loader sample (“ConsoleApplication2.exe”) that used Microsoft Warbird code-protection to obscure shellcode execution, alongside custom API-hashing and obfuscation. Rapid7 indicated the reporting includes actionable IOCs to support detection and response. Separate reporting on Pulsar RAT describes a different Windows malware campaign (persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run, PowerShell loaders, Donut shellcode injection, and Discord webhook exfiltration) and does not appear connected to the Notepad++/Chrysalis activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Rapid7 Labs and Rapid7 MDR disclosed a sophisticated intrusion they attributed with moderate confidence to the China-linked APT Lotus Blossom. The report detailed delivery of a previously undocumented backdoor named Chrysalis through abused Notepad++-related infrastructure, alongside use of Metasploit and Cobalt Strike.
The attacker's access to the compromised Notepad++ hosting infrastructure was terminated on December 2, 2025, ending the update-request hijacking that had persisted since June. Afterward, Notepad++ migrated hosting providers and rotated credentials.
Notepad++ released version 8.8.9 in December 2025 to address insufficient update verification in older versions. The weakness had enabled tampered updater flows to deliver malicious installers in the supply-chain compromise.
No payloads were detected from the campaign beginning in November 2025, indicating the malicious delivery activity had ceased by then. This marked a visible drop-off in observed exploitation before the infrastructure access was terminated.
Kaspersky observed three distinct infection chains linked to the campaign between July and October 2025, affecting a small set of victims in APAC and other regions. Reported victim sectors included telecom, government, transportation, finance, and IT services.
Infrastructure hosting Notepad++ was compromised, allowing selective redirection of some software update requests to attacker-controlled servers. Reporting indicates this malicious hijacking began in June 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourceletsdatascience.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors compromised **Notepad++** update infrastructure at the hosting-provider level and used it to redirect download/update traffic to attacker-controlled servers, enabling distribution of malicious updates to selected targets. Reporting described a multi-month intrusion window (mid-2025 through late 2025) in which attackers initially gained access to the shared hosting environment, then—after losing direct server access following maintenance—continued operating by leveraging retained valid credentials for internal services to keep redirecting requests from `https://notepad-plus-plus.org/getDownloadUrl.php` to malicious infrastructure. Technical reporting described **three distinct infection chains** observed during the operation, with targeting across government, financial, and IT sectors in multiple countries (including Vietnam, El Salvador, Australia, and the Philippines). The activity included abuse of legitimate software (e.g., *ProShow*), malicious Lua scripts, and deployment of the **Chrysalis backdoor**; CERT-EU’s February 2026 cyber brief also highlighted the incident as a **Notepad++ supply-chain compromise** attributed in open reporting to the China-linked group **Lotus Blossom**.
Jun 29, 2026
Notepad++ confirmed that its website and update distribution path were compromised, enabling a supply-chain attack that delivered malicious payloads to some users. Reporting and follow-on analysis tied the activity to infrastructure associated with the Chinese espionage group **Lotus Blossom**, with researchers describing a campaign that abused trusted software delivery to gain initial access and establish persistence on victim systems. Censys and other researchers mapped malicious network infrastructure used in the operation, while incident-response guidance and public triage tooling were released to help defenders identify affected hosts and hunt for indicators of compromise. Analysis from multiple firms said the intrusion appears to have run for months in 2025, raising concern that organizations using Notepad++ should review update activity, inspect outbound connections to known attacker infrastructure, and validate whether developer or hosting environments were tampered with.
Jul 12, 2026
Notepad++ released **v8.9.2** to harden its update process after a state-linked intrusion enabled attackers to **hijack update traffic** and selectively deliver malware to targeted users. The new “**double-lock**” design adds cryptographic verification of the **signed XML** update metadata returned by `notepad-plus-plus[.]org` (via **XMLDSig**) and complements earlier protections (introduced in **v8.8.9+**) that verify the **signed installer** downloaded from GitHub. Additional security changes to the *WinGUp* auto-updater include removing `libcurl.dll` to reduce DLL side-loading risk, removing insecure cURL SSL options (`CURLSSLOPT_ALLOW_BEAST`, `CURLSSLOPT_NO_REVOKE`), and restricting plugin-management execution to binaries signed with the same certificate as WinGUp. Reporting attributes the compromise to a China-linked actor (including **Lotus Blossom**) that abused a **shared hosting provider-level breach** to intercept and redirect update requests between **June and December 2025**, with selective victim targeting spanning government, telecom, and critical infrastructure—primarily in Southeast Asia but also affecting other regions. The campaign leveraged weaknesses in older WinGUp verification to deliver a malicious **NSIS** installer (`update.exe`) and execute follow-on payloads; described chains include a Lua script injection path delivering **Cobalt Strike** and another using **DLL sideloading** (including abuse of a legitimate Bitdefender component `BluetoothService.exe` to load a malicious `log.dll`) to deploy the **Chrysalis** backdoor. Notepad++ also fixed **CVE-2026-25926** (CVSS 7.3), an **unsafe search path** issue that could allow arbitrary code execution by launching Windows Explorer without an absolute path, potentially enabling execution of a malicious `explorer.exe` if the working directory is attacker-controlled.
Jun 29, 2026