Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
Russia-aligned UAC-0099 uses fake Notepad++ plugin to deliver MATCHBOIL.V2 malware.
CERT-UA has identified a new campaign by the Russia-aligned threat group UAC-0099, which uses a malicious Notepad++ plugin to compromise Windows systems. The attack chain involves phishing emails, VBScript, and multiple components including a legitimate Notepad++ installation and a malicious DLL, ultimately deploying the MATCHBOIL.V2 malware. This activity is believed to be part of espionage efforts, with the group previously observed exploiting WinRAR vulnerabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CERT-UA?
Get an email when a new story names CERT-UA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonUAC-0099, a Russia-aligned threat actor, is exploiting user trust in legitimate software by delivering a malicious Notepad++ plugin bundled with a real application installation to avoid suspicion. The attack relies on phishing emails and DLL-based malware delivery, highlighting how supply chain trust and plugin ecosystems can be weaponized against unsuspecting users. Because the malicious DLL is loaded alongside a legitimate tool, traditional signature-based defenses may fail to flag it. This matters because espionage-focused campaigns like this target sensitive organizational data, and the use of trusted application contexts makes detection and user recognition of the threat significantly harder.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — MATCHBOIL.V2
- malware — BURNYBEAR
- malware — LUNCHPOKE
- malware — LONEPAGE
- malware — MATCHWOK
- malware — DRAGSTARE