UAC-0099 MATCHBOIL.V2 Campaign: Defending Against Fake Notepad++ Plugins

Introduction

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a critical warning regarding a new campaign orchestrated by the Russia-aligned threat cluster UAC-0099. This group, historically known for exploiting security flaws in WinRAR, has shifted tactics to deliver the MATCHBOIL.V2 malware via a malicious Notepad++ plugin.

This attack highlights a sophisticated supply-chain style compromise where a trusted developer tool is weaponized. Since Notepad++ is a ubiquitous utility in developer and engineering environments, the potential for lateral movement and data exfiltration is high. Defenders must immediately audit their environments for unauthorized plugin installations and prepare detection mechanisms for this specific threat.

Technical Analysis

Threat Actor: UAC-0099 (Russia-aligned) Target: Windows systems running Notepad++ Payload: MATCHBOIL.V2

The Attack Vector

UAC-0099 is distributing a malicious program disguised as a legitimate Notepad++ plugin. Notepad++ supports extensibility via DLL-based plugins, which run within the context of the application's process.

Initial Delivery: The threat actor lures targets—likely via spear-phishing or compromised download sites—to install a fake plugin.
Execution: When Notepad++ loads, it automatically loads the DLL files located in its plugins directory. The malicious plugin is executed immediately upon application launch or activation.
Payload Deployment: The plugin serves as a dropper for MATCHBOIL.V2. While specific technical details of MATCHBOIL.V2's C2 infrastructure are still emerging, the delivery mechanism grants the malware the permissions of the user running Notepad++.

Risk Assessment

Privilege Context: If a user runs Notepad++ with Administrator privileges (common for editing system files like hosts or config files), the malicious plugin and subsequent MATCHBOIL.V2 payload inherit those high privileges.
Persistence: By residing in the plugins directory, the malware achieves persistence across application restarts.
Detection Difficulty: The traffic and behavior may appear as legitimate application usage if baseline monitoring for Notepad++ is not strictly defined.

Detection & Response

To combat this threat, we must focus on behavioral anomalies: text editors spawning shells, unsigned DLLs in plugin directories, and unauthorized file modifications.

Sigma Rules

The following Sigma rules identify suspicious child processes spawned by Notepad++ and the creation of unsigned DLLs in plugin paths.

YAML

---
title: Suspicious Child Process Spawned by Notepad++
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Notepad++ spawning suspicious shells or binaries, indicative of malicious plugin activity such as the UAC-0099 MATCHBOIL.V2 campaign.
references:
  - https://cert.gov.ua
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\notepad++.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
  condition: selection
falsepositives:
  - Legitimate user automation using NppExec plugin (rare)
level: high
---
title: Unsigned DLL Creation in Notepad++ Plugins Directory
id: 0d1e2f3a-4b5c-6d7e-8f9a-0b1c2d3e4f5a
status: experimental
description: Detects the creation of DLL files in the Notepad++ plugins directory, which may indicate a malicious plugin drop.
references:
  - https://cert.gov.ua
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Notepad++\plugins\'
      - '\Notepad++\plugins\Config\'
    TargetFilename|endswith: '.dll'
  condition: selection
falsepositives:
  - Official plugin updates or installations
level: medium

Microsoft Sentinel / Defender KQL

Hunt for instances of Notepad++ spawning command-line interfaces or script hosts, which is highly abnormal behavior for a text editor.

KQL — Microsoft Sentinel / Defender

DeviceProcessEvents
| where InitiatingProcessFileName =~ "notepad++.exe"
| where FileName in~ ("powershell.exe", "cmd.exe", "rundll32.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for recently modified DLLs in the Notepad++ plugins directory, which could indicate the installation of the fake UAC-0099 plugin.

VQL — Velociraptor

-- Hunt for suspicious DLLs in Notepad++ plugin directories
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='*/Notepad++/plugins/*.dll')
WHERE Mtime > now() - 7d
   -- Exclude known good hashes if available in your baseline

Remediation Script (PowerShell)

Use this script to audit your Windows endpoints for unsigned plugins in the Notepad++ directory. Ensure you run this with appropriate administrative privileges to access all user profiles.

PowerShell

# Audit Notepad++ Plugins for UAC-0099 MATCHBOIL.V2 indicators
# This script scans default plugin locations for unsigned DLLs.

$PluginPaths = @(
    "$envProgramFiles\Notepad++\plugins",
    "${env:ProgramFiles(x86)}\Notepad++\plugins",
    "$envLOCALAPPDATA\Notepad++\plugins"
)

$SuspiciousFound = $false

foreach ($Path in $PluginPaths) {
    if (Test-Path $Path) {
        Write-Host "[+] Auditing plugins in: $Path" -ForegroundColor Cyan
        Get-ChildItem -Path $Path -Filter "*.dll" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Sig = Get-AuthenticodeSignature -FilePath $_.FullName
            if ($Sig.Status -ne "Valid") {
                Write-Host "[!] WARNING: Unsigned or invalid plugin found: $($_.FullName)" -ForegroundColor Red
                Write-Host "    Signer Status: $($Sig.Status)" -ForegroundColor DarkRed
                $SuspiciousFound = $true
                # Optional: Quarantine logic
                # Move-Item -Path $_.FullName -Destination "C:\Quarantine\" -Force
            } else {
                Write-Host "[+] Valid Plugin: $($_.Name) (Signed by: $($Sig.SignerCertificate.Subject))" -ForegroundColor Green
            }
        }
    } else {
        Write-Host "[-] Path not found: $Path" -ForegroundColor Gray
    }
}

if (-not $SuspiciousFound) {
    Write-Host "[+] No unsigned plugins detected in standard paths." -ForegroundColor Green
}

Remediation

Audit Installed Plugins: Immediately review all installed Notepad++ plugins on developer and engineering workstations. Remove any that are not explicitly approved by your IT security policy.
Verify Digital Signatures: Ensure all remaining plugins are digitally signed by a trusted certificate authority. The PowerShell script provided above automates this check.
Restrict Plugin Installation: Modify file system permissions on the Notepad++\plugins directory to prevent standard users from writing new files. Only allow administrative accounts to install or update plugins.
Application Control: Implement application allowlisting (e.g., AppLocker or Windows Defender Application Control) to prevent the execution of unsigned DLLs within the Notepad++ directory structure.
User Awareness: Alert your user base to the risks of installing "free" plugins from unverified sources. Remind them that UAC-0099 is actively weaponizing popular utilities.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub