UAC-0099 Weaponizes Notepad++ Plugins for Malware Sideloading

Since mid-2026, the Russia-aligned threat cluster UAC-0099 has shifted tactics to target Windows systems using trojanized legitimate software. The campaign employs phishing emails containing disguised VBScripts that deploy a full, legitimate installation of Notepad++ along with a malicious plugin. This plugin, codenamed LUNCHPOKE, functions as the initial loader for a persistent backdoor chain. Evidence suggests UAC-0099 acts as an initial access provider for APT44 (Sandworm).

The technical workflow relies on DLL sideloading via Notepad++'s standard plugin architecture rather than a software vulnerability. The chain culminates in the MATCHBOIL.V2 loader, which collects system fingerprints through WMI and beacons to a C2 server for secondary payloads. Parallel reports also highlight activity from Laundry Bear (TA458) using 'half-click' XSS exploits (CVE-2025-66376) to target Zimbra and other webmail servers for espionage.

These operations emphasize an increasing trend of Russian state-sponsored actors abusing trusted developer tools and productivity software to evade traditional detection. The modular nature of these backdoors allows attackers to deploy varied final payloads once persistence is established, posing a significant risk to government and commercial infrastructure in Ukraine and NATO allies.