UAC-0099 Deploys MATCHBOIL.V2 Malware via Counterfeit Notepad++ Plugin

Key Findings

• UAC-0099, a Russia-aligned threat group active since mid-2022, is distributing MATCHBOIL.V2 malware through trojanized Notepad++ plugins via phishing campaigns
• Attack chain begins with a phishing email containing an image that, when clicked, downloads a VBScript disguised as a PDF document from a file-sharing service
• The VBScript downloads Notepad++ version 8.8.3 bundled with a malicious DLL plugin called LUNCHPOKE that establishes persistence through scheduled tasks running every three minutes
• BURNYBEAR loader executes MATCHBOIL.V2, a C#-based malware capable of delivering secondary payloads, with built-in sabotage logic that exhausts system resources if run without correct arguments
• Campaigns primarily target Ukrainian organizations, with potential for broader deployment against NATO allies
• CERT-UA recommends updating WinRAR, 7-Zip, and Notepad++ to prevent exploitation of known vulnerabilities

Background

UAC-0099 has been conducting cyber operations against Ukrainian targets since at least mid-2022. The group is known for leveraging security flaws in legitimate software to deliver malware families including LONEPAGE, MATCHBOIL, MATCHWOK, and DRAGSTARE. Previous campaigns relied on WinRAR vulnerabilities and phishing emails as primary infection vectors. The latest activity represents a notable shift in delivery methodology, suggesting continued development and refinement of their operational toolkit over a three-year period.

Attack Methodology

The infection chain starts with a deceptively simple phishing email containing an image attachment. When clicked, the image opens a URL concealed behind a link shortener service, directing victims to a file-sharing platform such as EasySend[.]co. From there, a ZIP archive is downloaded containing a VBScript file with a double extension designed to appear as a PDF document.

Executing the VBScript triggers simultaneous actions. A legitimate decoy PDF downloads and displays to the victim, creating the impression that the attachment opened normally. Meanwhile, in the background, the script silently downloads a second archive named Evernote.zip containing the complete infection toolkit.

Malware Components

The Evernote.zip archive contains several components working in concert. A full copy of legitimate Notepad++ version 8.8.3 provides cover for the malicious activity. The NppExport.dll plugin, classified as LUNCHPOKE, serves as the orchestrator. A password-protected RAR archive labeled updater.rar contains the actual payload. A legitimate WinRAR executable is included to extract the protected archive without raising suspicion.

When Notepad++ launches normally, it automatically loads NppExport.dll as part of its standard plugin loading process. This triggers LUNCHPOKE to extract the password-protected archive using the bundled WinRAR binary and deploy the contained files to hidden directories.

Persistence and Execution

LUNCHPOKE establishes persistence through Windows scheduled tasks configured to execute RemoteLibUpdater.exe every three minutes. This aggressive interval ensures the malware remains active even if individual processes terminate unexpectedly. The malware copies the legitimate schtasks.exe utility to a disguised location to obscure task creation in system logs.

The persistence mechanism uses randomized directory names that change between samples, making signature-based detection more difficult. Files are placed in hidden system directories including Windows\Libraries and Windows\Wallpapers, locations often overlooked during routine system administration.

Payload Delivery

RemoteLibUpdater.exe, identified as BURNYBEAR, functions as a loader for InitTest.dll. This DLL is a modified version of MATCHBOIL designated MATCHBOIL.V2, indicating active development and iterative improvements to the malware family. As a C#-based loader, MATCHBOIL.V2 can retrieve and execute arbitrary secondary payloads, providing the attackers with flexibility in their post-compromise operations.

Anti-Analysis Features

BURNYBEAR includes unusual built-in sabotage logic designed to hinder reverse engineering and sandbox detection. If RemoteLibUpdater.exe executes without the correct command-line arguments, it activates code designed to exhaust system resources by consuming excessive RAM and CPU cycles. This behavior serves dual purposes: it produces unexpected output that confuses manual analysts examining the binary, and it provides a rough sandbox detection mechanism since automated analysis environments typically execute binaries without arguments.

This approach demonstrates operational sophistication beyond basic malware development, suggesting the group has invested in understanding security research and analysis methodologies.

Broader Campaign Context

The UAC-0099 campaign targeting Ukrainian organizations with this trojanized plugin represents part of a broader pattern where Russian threat actors test new techniques domestically before deploying them against NATO allies. Ukraine serves as both a priority target and a testing ground for evolving cyber capabilities.

The disclosure of this campaign coincides with separate Russian-linked operations including Laundry Bear's exploitation of Zimbra servers and TA458's Operation RoundPress targeting multiple webmail platforms through half-click XSS exploits. This convergence indicates sustained, coordinated pressure from multiple Russia-aligned groups across different attack vectors.

Defensive Recommendations

CERT-UA advises organizations to update WinRAR, 7-Zip, and Notepad++ to the latest available versions to eliminate potential vulnerabilities that could be exploited in follow-on attacks. Beyond patching, security teams should monitor for scheduled tasks with randomized naming conventions, unusual three-minute execution intervals, and suspicious plugin loading by text editors.

Network monitoring should flag downloads from free file-sharing services like EasySend[.]co, particularly when triggered by image attachments in emails. Behavioral analysis should watch for Notepad++ spawning WinRAR processes or creating tasks to execute unfamiliar binaries, patterns that deviate significantly from normal editor functionality.

Sources

• https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html
• https://securityaffairs.com/195923/cyber-warfare-2/uac-0099-is-now-hiding-malware-inside-a-fake-notepad-plugin-to-target-ukrainian-organizations.html
• https://www.threads.com/@thecybersecurityhub/post/DbKpi0GG_Qc/fake-notepad-plugin-delivers-matchboil-v-in-uac-attacks-utm-medium-threads
• https://x.com/TheCyberSecHub/status/2080547970651693375
• https://mallory.ai/stories/019f89f3-f476-75be-a6ed-e531a7457b74