CERT-UA published a new advisory attributing a phishing campaign to UAC-0099, a Russia-aligned threat actor active since at least mid-2022 and previously known for exploiting WinRAR vulnerabilities and using phishing emails to deliver malware families including LONEPAGE, MATCHBOIL, and DRAGSTARE.
The latest campaign, observed earlier this summer, uses a trojanized Notepad++ plugin as the infection mechanism. It’s a meaningful change in delivery method for a group that’s been refining its toolset steadily for three years.
The attack starts with a phishing email carrying an image attachment. Clicking it opens a URL hidden behind a link shortener, which redirects to a file-sharing service such as EasySend[.]co where a ZIP archive waits. Inside the ZIP is a VBScript file disguised as a PDF document.
Running the VBScript triggers two things simultaneously. A legitimate decoy PDF downloads and opens in front of the victim to hold their attention, while in the background the script fetches a second archive called Evernote.zip. That archive contains a full working copy of Notepad++ version 8.8.3, a malicious DLL plugin named NppExport.dll, a password-protected RAR archive called updater.rar, and a legitimate WinRAR executable.
“The mentioned archive contains a VBS script with a double extension, the name of which may intentionally contain a significant number of spaces before the final .vbs extension , for example “Zavodskyi rayon.pdf .vbs”. In turn, when launched, the script will download a decoy file (for example “Zavodskyi rayon.pdf”) and the “Evernote.zip” archive.” reads the advisory. “The archive contains a full set of Notepad++ program components version 8.8.3, as well as the “/plugins/NppExport/” directory, which contains a third-party plugin library “NppExport.dll”, a password-protected archive “updater.rar” and the WinRAR executable file “winrar.exe”.”
The VBScript extracts everything and launches Notepad++, which loads NppExport.dll as it starts up. The victim sees a text editor open normally and has no reason to suspect anything happened.
The malicious DLL, codenamed LUNCHPOKE by CERT-UA, uses the bundled WinRAR binary to unpack the password-protected archive. That archive contains two files: RemoteLibUpdater.exe and InitTest.dll. LUNCHPOKE copies them to a specific directory and creates a scheduled task that runs RemoteLibUpdater.exe every three minutes. The three-minute interval is aggressive and keeps the implant active even after unexpected process termination.
“The file “NppExport.dll” is classified as a LUNCHPOKE utility , the main purpose of which is to create the directory ” %PUBLIC%\Libraries\fFthY3-Ytrevc3w-ab3\ “, extract the contents of the archive “updater.rar” to it using a password (in particular, the files “RemoteLibUpdater.exe” and “InitTest.dll”), copy the standard utility “schtasks.exe” to the file ” %PUBLIC%\Wallpapers\Background.exe ” and create a scheduled task with the name ” \W1n3r-U09oTy-Ap5\Updates ” to run the file ” %PUBLIC%\Libraries\fFthY3-Ytrevc3w-ab3\RemoteLibUpdater.exe ” with the arguments “setup nodisplay” every three minutes (the name of the directory ” fFthY3-Ytrevc3w-ab3 ” changes).” states CERT-UA.
RemoteLibUpdater.exe is BURNYBEAR, a loader whose job is to execute InitTest.dll. That DLL is a modified version of MATCHBOIL, a C#-based loader capable of fetching and running additional payloads, now designated MATCHBOIL.V2. The update indicates active development on the toolchain rather than a static deployment.
BURNYBEAR includes an unusual built-in sabotage behavior.
“The executable file “RemoteLibUpdater.exe” is classified as a BURNYBEAR utility , the functionality of which is designed to load the DLL file “InitTest.dll”. However, if “RemoteLibUpdater.exe” is launched incorrectly, namely without specifying arguments, BURNYBEAR instead activates logic designed to exhaust computer resources (RAM and CPU).” states the report.
That behavior serves a dual purpose: it makes behavioral analysis harder by producing unexpected output if someone runs the binary without the correct arguments, and it provides a rough sandbox detection mechanism since automated analysis environments often execute binaries without arguments.
This campaign arrives alongside a separate U.S. government advisory documenting Laundry Bear, another Russia-linked actor, running a phishing campaign against Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025. That campaign uses a “half-click” exploit abusing CVE-2025-66376 to deliver malicious JavaScript called ZimReaper, which can harvest email communications without requiring the victim to click anything beyond opening a malicious email in a vulnerable webmail client. The U.S. government’s assessment of Laundry Bear’s intent is unambiguous:
CERT-UA recommends updating WinRAR, 7-Zip, and Notepad++ to their latest versions to close known vulnerabilities that groups like UAC-0099 use to facilitate follow-on stages once they’ve established a foothold.
The campaign’s use of a bundled legitimate WinRAR executable rather than relying on one already installed is notable: it means the attack chain doesn’t depend on the victim having a vulnerable version present, which makes the update recommendation more relevant as a general hygiene measure than as a specific remediation for this particular campaign. Organizations receiving unexpected emails with image attachments that open URLs through link shorteners should treat those as high-risk regardless of what the displayed content looks like.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Notepad++)