Full Report
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that's dressed up as a Notepad++ plugin to compromise Windows systems. The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously observed weaponizing security flaws in WinRAR software to
Analysis Summary
# Threat Actor: UAC-0099
## Attribution & Identity
* **Actor Name:** UAC-0099
* **Affiliation:** Russia-aligned / Russian government-backed.
* **Historical Associations:** Often linked to espionage activities targeting Ukraine; frequently uses Ukraine as a "test bench" for techniques before broader deployment against NATO allies.
## Activity Summary
The group is currently conducting a campaign involving a malicious Notepad++ plugin to compromise Windows systems. The attack chain begins with phishing emails containing image attachments that lead to ZIP archives hosted on file-sharing sites. The campaign leverages sophisticated multi-stage loaders to deploy a new version of their signature malware, MATCHBOIL.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing emails with image attachments; use of link shorteners and file-sharing services (e.g., EasySend[.]co).
* **Phishing/Social Engineering:** ZIP archives containing VBScripts that masquerade as PDF documents.
* **Execution & Masquerading:** Use of a legitimate Notepad++ binary (v8.8.3) to sideload a malicious DLL named `NppExport.dll`.
* **Persistence:** Establishing a scheduled task to run a loader (`RemoteLibUpdater.exe`) every three minutes.
* **Evasion & Distraction:** VBScript displays a decoy PDF while background infection occurs.
* **Anti-Analysis:** The loader `BURNYBEAR` includes logic to exhaust host resources (RAM and CPU) if launched without the correct arguments, potentially crashing analysis environments.
* **Vulnerability Exploitation:** Historically observed weaponizing CVEs in WinRAR (e.g., related to file extension spoofing) to deliver payloads.
## Targeting
* **Sectors:** Government and commercial organizations (primarily targeted for espionage).
* **Geography:** Ukraine (primary/initial), with strategic shifts toward Western and NATO countries.
* **Victims:** Disclosed victims include various Ukrainian entities; general Windows users in targeted regions.
## Tools & Infrastructure
* **Malware Families:**
* **LONEPAGE:** Historically used.
* **LUNCHPOKE:** The malicious Notepad++ plugin DLL (`NppExport.dll`).
* **BURNYBEAR:** The loader binary (`RemoteLibUpdater.exe`).
* **MATCHBOIL.V2:** An updated C#-based loader/payload (the evolution of MATCHBOIL/MATCHWOK).
* **DRAGSTARE:** Associated payload.
* **Infrastructure:**
* **URL/File Sharing:** hxxps://EasySend[.]co
* **Files:** `Evernote.zip`, `updater.rar`, `InitTest.dll`.
## Implications
UAC-0099 represents a persistent espionage threat. Their transition from simple phishing to more complex "half-click" exploits (as seen in related Russian actor clusters) and the use of legitimate software sideloading (Notepad++) suggests an increasing level of sophistication. Their habit of using Ukraine as a testing ground implies that these techniques will likely appear in global campaigns shortly after their initial discovery in the Ukrainian theater.
## Mitigations
* **Software Updates:** Immediately update Notepad++, WinRAR, and 7-Zip to their latest versions to mitigate exploitation of known vulnerabilities.
* **Email Security:** Implement strict filtering for ZIP and VBScript attachments; block access to known link-shortener and unauthorized file-sharing domains.
* **Execution Control:** Monitor for unauthorized scheduled tasks and unusual DLL loads from common application directories (AppLocal/Temp).
* **Behavioral Monitoring:** Use EDR solutions to detect "resource exhaustion" behavior or legitimate applications (like Notepad++) spawning unexpected child processes or network connections.