Loading story…
CERT-UA warned that the UAC-0099 threat cluster has shifted its delivery chain against organizations in Ukraine, using phishing emails with image attachments and shortened links to deliver ZIP archives containing a double-extension VBS file. That script retrieves a decoy document and an archive bundling a legitimate Notepad++ 8.8.3 installer with a malicious NppExport.dll, abusing the editor’s normal plugin-loading behavior rather than a supply-chain compromise or software vulnerability. The archive also includes additional components such as updater.rar and, in some cases, WinRAR, which the malware can also fetch from Dropbox if it is not already present.
Once launched, the fake Notepad++ plugin installs LunchPoke, which extracts a password-protected archive, creates persistence through a scheduled task, and starts BurnyBear to load InitTest.dll, a modified MatchBoil V2 implant. CERT-UA said MatchBoil V2 continues to receive updated configuration data, including command-and-control infrastructure and follow-on payloads; published indicators include the domain kaufen-qpon[.]icu and IP 64.94.84[.]204. The agency added that UAC-0099 has previously been linked to initial access activity associated with APT44 (Sandworm) operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CERT-UA released technical details and indicators of compromise for the campaign, including file, network, and host indicators. The report identified infrastructure such as the C2 domain kaufen-qpon[.]icu and IP address 64.94.84[.]204.
CERT-UA reported that in mid-summer 2026 the UAC-0099 threat cluster changed its tactics, techniques, and procedures, using phishing emails with image attachments, shortened URLs, and ZIP archives containing a double-extension VBS script. The updated chain abuses a legitimate Notepad++ 8.8.3 installation for DLL side-loading and deploys LunchPoke, BurnyBear, and MatchBoil V2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **UAC-0184**—also tracked as **UNC5435** and **MB-0007**—is using spearphishing **LNK** files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke **`bitsadmin`** and **`mshta`** to retrieve HTA payloads from disposable infrastructure hosted on **Cloudflare Pages**, **Netlify**, and novelty TLDs, then fetch **`dctrprraclus.zip`**. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an **AES-256-CBC** base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext. The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate **Plane9** components, progressing through **`Cluster-Overlay64.exe`**, **`Plane9Engine.dll`**, **`openvr_api.dll`**, **`kernel-diag.lib`**, and a decoded **`evr.dll`** stage that extracts **`filter.bin`**, whose pseudo-PNG **IDAT** data is XOR-decoded and **LZNT1**-decompressed into a final bundle. A parallel path uses the signed **Bitdefender Endpoint Security** deployer **`bddeploy.exe`** to sideload a malicious **`deploy.dll`** via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed **`VSLauncher.exe`** and a PassMark-derived **`input.dll`** believed to provide covert networking and possible process-dump capability, while telemetry tied to **trojan.leopard/bitsuh** and multicast or TCP traffic on **port 31339** has emerged as a consistent hunting lead.
Jun 29, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Rapid7 Labs and the Rapid7 MDR team reported a targeted espionage campaign attributed to the **Chinese APT group Lotus Blossom**, in which attackers **compromised infrastructure used to distribute Notepad++** and leveraged it to deliver a previously undocumented backdoor dubbed **Chrysalis**. Victimology described in the reporting includes government, telecom, aviation, media, and other **critical infrastructure** organizations, with activity historically concentrated in Southeast Asia and later observed in Central America. The intrusion chain observed on affected hosts included execution of `notepad++.exe` and `GUP.exe` followed by a suspicious `update.exe` downloaded from `95.179.213.0`, consistent with abuse of the Notepad++ distribution channel; Rapid7 noted that while prior public reporting referenced plugin replacement and updater-related mechanisms, their forensics did not confirm a specific sub-mechanism beyond the observed execution sequence. Technical analysis described **NSIS installer-based delivery**, **DLL sideloading**, and multiple custom loaders, including a notable loader sample (“`ConsoleApplication2.exe`”) that used **Microsoft Warbird** code-protection to obscure shellcode execution, alongside custom API-hashing and obfuscation. Rapid7 indicated the reporting includes actionable **IOCs** to support detection and response. Separate reporting on **Pulsar RAT** describes a different Windows malware campaign (persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, PowerShell loaders, Donut shellcode injection, and Discord webhook exfiltration) and does not appear connected to the Notepad++/Chrysalis activity.
Jun 29, 2026