UAC-0099 Abuses Notepad++ Plugin Loading to Deploy LunchPoke and MatchBoil

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

UAC-0099

Malware

4 linked

BURNYBEAR MATCHBOIL.V2 LUNCHPOKE MatchBoil V2

Affected products

1 linked

Notepad++

Observables

59 linked

MD5 hash••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

URLhttps://•••••••.•••/••••••Domain•••••••••.netEmail address••••••••@•••••.•••IPv4 address•••.•••.••.•••MD5 hash••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+51

Indicator values are masked on this page. View all 59 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

7 references tracked. Mallory keeps watching after this page renders.

Help Net SecurityNews · Aug 31, 2026

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails - Help Net SecurityOpen source ↗

Security AffairsNews · Jul 24, 2026

UAC-0099 Is Now Hiding Malware Inside a Fake Notepad++ Plugin to Target Ukrainian OrganizationsOpen source ↗

The Hacker NewsNews · Jul 24, 2026

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 AttacksOpen source ↗

ScworldNews · Jul 23, 2026

Notepad++ used in new stealthy attacks targeting Ukraine | brief | SC MediaOpen source ↗

Cyber Security NewsNews · Jul 23, 2026

Hackers Abuse Notepad++ Plugins to Compromise Your System SilentlyOpen source ↗

Bleeping ComputerNews · Jul 23, 2026

Hackers abuse Notepad++ plugins to stealthily install malwareOpen source ↗

Cert UaAdvisories · Jul 21, 2026

CERT-UAOpen source ↗

On the same thread

Russia-aligned threat group **UAC-0099** has progressively refined the **MATCHBOIL** downloader to deploy the MATCHWOK espionage backdoor on Windows systems in Ukraine, according to ESET. Observed victims included transportation companies in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026. The spear-phishing chain uses links to archives containing VBScript files that download and execute MATCHBOIL, which collects victim identifiers, retrieves a concealed payload and installs the C# backdoor. Persistence is established through scheduled tasks or registry keys. Tracked since at least April 2024, MATCHBOIL has gained recurring command-and-control communication, repeated execution, revised persistence, commercial obfuscation, sandbox checks and deceptive graphical interfaces. The newest reported 2026 variant replaces an executable with a DLL run by a custom C# loader. ESET assesses UAC-0099’s alignment with Russian interests with medium confidence and reports that it can act as an initial access broker for Sandworm, Russia’s military intelligence Unit 74455; however, access transfers involving these victims were not established. Defenders should prioritize detection of archive-delivered VBScript, suspicious persistence changes and unusual C# loader activity.

Oct 10, 2026

UAC-0184 Expands HTA Loader With Bitdefender and Plane9 Sideload Chains

Researchers reported that **UAC-0184**—also tracked as **UNC5435** and **MB-0007**—is using spearphishing **LNK** files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke **`bitsadmin`** and **`mshta`** to retrieve HTA payloads from disposable infrastructure hosted on **Cloudflare Pages**, **Netlify**, and novelty TLDs, then fetch **`dctrprraclus.zip`**. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an **AES-256-CBC** base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext. The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate **Plane9** components, progressing through **`Cluster-Overlay64.exe`**, **`Plane9Engine.dll`**, **`openvr_api.dll`**, **`kernel-diag.lib`**, and a decoded **`evr.dll`** stage that extracts **`filter.bin`**, whose pseudo-PNG **IDAT** data is XOR-decoded and **LZNT1**-decompressed into a final bundle. A parallel path uses the signed **Bitdefender Endpoint Security** deployer **`bddeploy.exe`** to sideload a malicious **`deploy.dll`** via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed **`VSLauncher.exe`** and a PassMark-derived **`input.dll`** believed to provide covert networking and possible process-dump capability, while telemetry tied to **trojan.leopard/bitsuh** and multicast or TCP traffic on **port 31339** has emerged as a consistent hunting lead.

May 19, 2026

UAC-0056 Phishing Campaign Used Excel Lures to Deploy GraphSteel and GrimPlant in Ukraine

Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.

Mar 23, 2022

UAC-0099 Abuses Notepad++ Plugin Loading to Deploy LunchPoke and MatchBoil

How this story unfolded

ESET identifies UAC-0099 GuardBreaker AI-analysis evasion technique

CERT-UA publishes technical indicators for the UAC-0099 campaign

UAC-0099 changes TTPs and launches updated malware chain

Related entities

Threat actors

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

UAC-0099 Abuses Notepad++ Plugin Loading to Deploy LunchPoke and MatchBoil

How this story unfolded

ESET identifies UAC-0099 GuardBreaker AI-analysis evasion technique

CERT-UA publishes technical indicators for the UAC-0099 campaign

UAC-0099 changes TTPs and launches updated malware chain

Related entities

Threat actors

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

UAC-0099 Abuses Notepad++ Plugin Loading to Deploy LunchPoke and MatchBoil

How this story unfolded

ESET identifies UAC-0099 GuardBreaker AI-analysis evasion technique

CERT-UA publishes technical indicators for the UAC-0099 campaign

UAC-0099 changes TTPs and launches updated malware chain

Related entities

Threat actors

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

UAC-0099 Refines MATCHBOIL to Deploy Espionage Backdoor in Ukrainian Organizations

UAC-0184 Expands HTA Loader With Bitdefender and Plane9 Sideload Chains

UAC-0056 Phishing Campaign Used Excel Lures to Deploy GraphSteel and GrimPlant in Ukraine

UAC-0099 Abuses Notepad++ Plugin Loading to Deploy LunchPoke and MatchBoil

How this story unfolded

ESET identifies UAC-0099 GuardBreaker AI-analysis evasion technique

CERT-UA publishes technical indicators for the UAC-0099 campaign

UAC-0099 changes TTPs and launches updated malware chain

Related entities

Threat actors

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

UAC-0099 Refines MATCHBOIL to Deploy Espionage Backdoor in Ukrainian Organizations

UAC-0184 Expands HTA Loader With Bitdefender and Plane9 Sideload Chains

UAC-0056 Phishing Campaign Used Excel Lures to Deploy GraphSteel and GrimPlant in Ukraine