Key Findings UAC-0099, a Russia-aligned threat group active since mid-2022, is distributing MATCHBOIL.V2 malware through trojanized Notepad++ plugins via phishing campaigns Attack chain begins with a phishing email containing an image that, when clicked, downloads a VBScript disguised as a PDF document from a file-sharing service The VBScript downloads Notepad++ version 8.8.3 bundled with a malicious DLL plugin called LUNCHPOKE that establishes persistence through scheduled t
