Loading story…
Threat actors compromised Notepad++ update infrastructure at the hosting-provider level and used it to redirect download/update traffic to attacker-controlled servers, enabling distribution of malicious updates to selected targets. Reporting described a multi-month intrusion window (mid-2025 through late 2025) in which attackers initially gained access to the shared hosting environment, then—after losing direct server access following maintenance—continued operating by leveraging retained valid credentials for internal services to keep redirecting requests from https://notepad-plus-plus.org/getDownloadUrl.php to malicious infrastructure.
Technical reporting described three distinct infection chains observed during the operation, with targeting across government, financial, and IT sectors in multiple countries (including Vietnam, El Salvador, Australia, and the Philippines). The activity included abuse of legitimate software (e.g., ProShow), malicious Lua scripts, and deployment of the Chrysalis backdoor; CERT-EU’s February 2026 cyber brief also highlighted the incident as a Notepad++ supply-chain compromise attributed in open reporting to the China-linked group Lotus Blossom.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
In its February 2026 cyber brief published on 2026-03-02, CERT-EU highlighted the Notepad++ supply-chain compromise and attributed it to the China-linked Lotus Blossom campaign, adding broader threat-intelligence context to the incident.
On 2025-12-09, Notepad++ released version 8.8.9, hardening the WinGUp updater to verify installer signatures and certificates to reduce the risk of similar supply-chain abuse.
On 2025-12-02, the malicious redirection activity was remediated, ending the attackers' ability to route Notepad++ updater traffic to attacker-controlled infrastructure.
During the compromise, victims attempting to update Notepad++ received a malicious NSIS installer named update.exe that performed reconnaissance and data exfiltration, then launched one of several infection chains including Cobalt Strike Beacon delivery and deployment of the Chrysalis backdoor.
On 2025-09-02, the attackers reportedly lost direct access to the shared hosting server but retained valid internal-service credentials, allowing them to continue redirecting requests from notepad-plus-plus.org to attacker-controlled servers.
Between June and December 2025, attackers compromised Notepad++'s update infrastructure through a hosting-provider-level breach, enabling them to tamper with updater traffic and serve malicious downloads to users seeking updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ confirmed that its website and update distribution path were compromised, enabling a supply-chain attack that delivered malicious payloads to some users. Reporting and follow-on analysis tied the activity to infrastructure associated with the Chinese espionage group **Lotus Blossom**, with researchers describing a campaign that abused trusted software delivery to gain initial access and establish persistence on victim systems. Censys and other researchers mapped malicious network infrastructure used in the operation, while incident-response guidance and public triage tooling were released to help defenders identify affected hosts and hunt for indicators of compromise. Analysis from multiple firms said the intrusion appears to have run for months in 2025, raising concern that organizations using Notepad++ should review update activity, inspect outbound connections to known attacker infrastructure, and validate whether developer or hosting environments were tampered with.
Jul 12, 2026
Rapid7 Labs and the Rapid7 MDR team reported a targeted espionage campaign attributed to the **Chinese APT group Lotus Blossom**, in which attackers **compromised infrastructure used to distribute Notepad++** and leveraged it to deliver a previously undocumented backdoor dubbed **Chrysalis**. Victimology described in the reporting includes government, telecom, aviation, media, and other **critical infrastructure** organizations, with activity historically concentrated in Southeast Asia and later observed in Central America. The intrusion chain observed on affected hosts included execution of `notepad++.exe` and `GUP.exe` followed by a suspicious `update.exe` downloaded from `95.179.213.0`, consistent with abuse of the Notepad++ distribution channel; Rapid7 noted that while prior public reporting referenced plugin replacement and updater-related mechanisms, their forensics did not confirm a specific sub-mechanism beyond the observed execution sequence. Technical analysis described **NSIS installer-based delivery**, **DLL sideloading**, and multiple custom loaders, including a notable loader sample (“`ConsoleApplication2.exe`”) that used **Microsoft Warbird** code-protection to obscure shellcode execution, alongside custom API-hashing and obfuscation. Rapid7 indicated the reporting includes actionable **IOCs** to support detection and response. Separate reporting on **Pulsar RAT** describes a different Windows malware campaign (persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, PowerShell loaders, Donut shellcode injection, and Discord webhook exfiltration) and does not appear connected to the Notepad++/Chrysalis activity.
Jun 29, 2026
Notepad++ maintainers confirmed a **months-long compromise of the project’s former shared hosting/update infrastructure** that enabled a likely **Chinese state-sponsored** actor to selectively hijack update traffic and redirect targeted users to attacker-controlled servers hosting malicious payloads. The activity ran from **June 2025 to early December 2025** and was characterized as *highly selective* rather than broad “spray and pray” distribution, indicating a well-resourced adversary focused on specific victims. Investigations attributed the intrusion to an **infrastructure-level takeover** (compromise of the shared hosting environment) rather than a vulnerability in the Notepad++ codebase itself. The attacker-controlled redirection path included the updater’s `getDownloadUrl.php` endpoint and leveraged **insufficient update verification in older updater/Notepad++ versions** (prior to **v8.8.9**, including older *WinGUp* behavior) that did not strictly enforce certificate/signature validation for downloaded installers. Reporting also describes multiple phases of access during the incident window, with the hosting provider ultimately evicting the attacker by **Dec 2, 2025**.
Jun 29, 2026