Notepad++ Supply Chain Attack Analysis

Executive Overview

A sophisticated state-sponsored cyber espionage campaign attributed to the China-linked Lotus Blossom Advanced Persistent Threat (APT) group successfully compromised Notepad++'s update distribution infrastructure for approximately six months (June through December 2, 2025). The attackers breached the shared hosting provider infrastructure, selectively redirecting update traffic from targeted users to malicious servers that delivered a previously undocumented backdoor named Chrysalis.

This incident represents a critical supply chain attack affecting one of the world's most popular text editors with over 3 million users. The attack demonstrates advanced infrastructure-level compromise techniques, patient reconnaissance, and surgical targeting consistent with state-sponsored espionage objectives rather than financially-motivated cybercrime.

Key Findings

• Infrastructure-level compromise of shared hosting provider, not direct application vulnerability
• Selective targeting of specific organizations with interests in East Asia
• Deployment of custom Chrysalis backdoor and commercial Cobalt Strike framework
• Six-month operational window with sophisticated persistence mechanisms
• Advanced evasion using DLL sideloading and Microsoft Warbird obfuscation
• Medium-to-high confidence attribution to Lotus Blossom APT group

Attack Timeline and Operational Phases

Date	Event
June 2025	Initial compromise of shared hosting provider infrastructure; attackers gain full administrative access to server hosting notepad-plus-plus.org
June - Sep 2, 2025	Active compromise period with direct server access; selective redirection of update traffic to malicious infrastructure at 95.179.213.0
September 2, 2025	Scheduled kernel and firmware updates inadvertently terminate direct server access; attackers lose root-level control
Sep 2 - Dec 2, 2025	Attackers maintain stolen credentials to internal hosting services; continue limited traffic redirection capabilities
Early December 2025	Security researcher Kevin Beaumont identifies three victim organizations with Notepad++ as initial access vector
December 2, 2025	All attacker access definitively terminated; hosting provider completes credential rotation and vulnerability patching
December 2025	Notepad++ version 8.8.9 released with enhanced certificate and signature verification
January 2026	Don Ho migrates Notepad++ to new hosting provider with strengthened security controls
February 1-2, 2026	Public disclosure by Notepad++ developer and Rapid7 security research

Technical Attack Analysis

Initial Access Vector

The precise initial access method remains under investigation as attackers thoroughly sanitized entry logs. Analysis of 400 GB of server logs by incident response teams identified signs of intrusion but no concrete indicators of the initial breach vector Based on threat intelligence analysis and Lotus Blossom's known tactics, techniques, and procedures (TTPs), the most probable access methods include:

• Credential-based compromise: Phishing of hosting provider administrator credentials, exploitation of leaked VPN credentials (documented Lotus Blossom TTP in 2025 campaigns), or credential stuffing attacks
• Lateral movement from compromised co-tenant: Initial compromise of another website on the shared hosting server followed by privilege escalation to gain administrative access
• Hosting control panel exploitation: Remote code execution vulnerability in cPanel, Plesk, or custom management interface (confirmed by hosting provider's statement about fixing vulnerabilities)

The hosting provider confirmed that "bad actors specifically searched for https://notepad-plus-plus.org/ domain with the goal to intercept the traffic to your website, as they might know the then-existing Notepad++ vulnerabilities related to insufficient update verification controls". This indicates targeted reconnaissance and deliberate selection of Notepad++ among all clients on the compromised shared server.

Infrastructure Manipulation and Persistence

Once administrative access was established, the attackers implemented sophisticated traffic interception mechanisms:

Phase 1: Direct Server Control (June - September 2, 2025)

• Full root/administrative access to shared hosting server
• Modification of web server configuration (Apache/Nginx) to intercept HTTP requests to notepad-plus-plus.org/update/getDownloadUrl.php
• Selective redirection logic targeting specific victim organizations based on IP ranges, user-agent strings, or geographic criteria.
• Mass of users received legitimate updates to minimize detection risk.

Phase 2: Credential-Based Persistence (September 2 - December 2, 2025)

Following September 2 maintenance that terminated direct server access, attackers maintained operations using:

• Stolen credentials for internal hosting service APIs and control panels.
• Continued ability to manipulate DNS settings and routing rules through legitimate administrative interfaces
• Reduced operational capability but sustained traffic redirection for high-value targets.

The hosting provider attempted to re-exploit at least one patched vulnerability after remediation, confirming both the sophistication of their access methods and the effectiveness of the December 2 mitigation measures.

Malware Delivery Chain

The attack leveraged vulnerabilities in older Notepad++ versions (prior to 8.8.9) that lacked sufficient update verification controls, specifically:

• No SSL certificate signature verification on update server responses
• No XMLDSig digital signature validation for server-provided update manifests.

Multi-Stage Infection Process:

• Update initiation: User launches Notepad++ update checker (GUP.exe) which contacts notepad-plus-plus.org/update/getDownloadUrl.php
• Traffic redirection: Compromised hosting infrastructure redirects targeted requests to attacker-controlled server at 95.179.213.0.
• Malicious payload delivery: Server responds with update.exe, a Nullsoft Scriptable Install System (NSIS) installer containing malware components.
• Component extraction: NSIS installer deploys four critical files to victim system
• DLL sideloading execution: Legitimate renamed Bitdefender binary (BluetoothService.exe) loads malicious log.dll
• Shellcode decryption: Malicious DLL decrypts and executes shellcode from encrypted BluetoothService file
• Backdoor deployment: Shellcode establishes persistence and deploys Chrysalis backdoor.

DLL Sideloading Technique

The attackers employed DLL sideloading, a sophisticated living-off-the-land binary (LOLBin) technique extensively used by Chinese APT groups.

Component	Type	Purpose
BluetoothService.exe	Legitimate binary	Renamed Bitdefender Submission Wizard; digitally signed by legitimate vendor
log.dll	Malicious DLL	Sideloaded by BluetoothService.exe; contains decryption and execution logic
BluetoothService	Encrypted payload	Shellcode containing Chrysalis backdoor
NSIS script	Installation logic	Orchestrates deployment and persistence configuration

This technique provides multiple defensive evasion benefits:

• Execution occurs within context of legitimately-signed binary, bypassing application whitelisting
• Antivirus solutions trust signed Bitdefender executable, reducing detection probability
• No direct exploitation required - abuses legitimate Windows DLL search order behavior
• Consistent with Lotus Blossom campaigns documented by Symantec in April 2025 using Trend Micro and Bitdefender binaries

Chrysalis Backdoor Analysis

Chrysalis represents a previously undocumented, feature-rich backdoor demonstrating active ongoing development. Technical analysis by Rapid7 identified the following capabilities:

Core Functionality

• Command and control: Contacts api.skycloudcenter[.]com for command reception and data exfiltration.
• Interactive shell: Spawns cmd.exe or PowerShell sessions for manual operator interaction
• System reconnaissance: Collects detailed host information including OS version, username, domain membership, installed software, and network configuration
• Process management: Creates, terminates, and enumerates processes on infected systems
• File operations: Full file system manipulation including upload, download, delete, and enumeration capabilities
• Data exfiltration: Compress and transmit sensitive documents and credentials to attacker infrastructure
• Persistence mechanisms: Deploys multiple registry keys, scheduled tasks, and service-based persistence
• Anti-forensics: Includes uninstall capabilities to remove traces on command.

Advanced Evasion: Microsoft Warbird Obfuscation

In addition to Chrysalis, attackers deployed a sophisticated loader (ConsoleApplication2.exe) exploiting Microsoft Warbird, an undocumented internal Microsoft code protection framework. This represents a significant evolution in evasion capabilities:

• Warbird is Microsoft's proprietary obfuscation technology for Windows licensing and DRM components
• Attackers weaponized public proof-of-concept code published by German firm Cirosec in September 2024.
• Loader embeds Metasploit block API shellcode and retrieves Cobalt Strike beacons through custom loader (conf.c).
• Uses undocumented system calls like NtQuerySystemInformation to evade traditional security solutions.
• Demonstrates rapid adaptation of public research into operational tooling within months

Hybrid Toolset Approach

The campaign demonstrates sophisticated integration of multiple malware categories:

• Custom malware: Chrysalis backdoor (unique to this campaign)
• Commercial frameworks: Cobalt Strike for post-exploitation and lateral movement
• Open-source tools: Metasploit shellcode and Impacket for remote execution.
• Multi-layered loaders: Service-based persistence with advanced obfuscation

This combination provides operational flexibility, attribution obfuscation, and resilience against defensive measures while maintaining sophisticated custom capabilities.

Threat Actor Attribution: Lotus Blossom APT

Rapid7 and multiple security vendors attribute this operation to the Lotus Blossom APT group with medium-to-high confidence.. Lotus Blossom is a China-linked cyber espionage group also tracked as:

• Billbug
• Bronze Elgin
• DRAGONFISH
• Lotus Panda
• Raspberry Typhoon
• Spring Dragon
• Thrip.

Historical Context and Targeting

Active since at least 2012, Lotus Blossom conducts long-term cyber espionage campaigns against:

• Government and military organizations
• Manufacturing and telecommunications sectors
• Media and critical infrastructure
• Aviation and defense industries
• Primary geographic focus: Southeast Asia (Vietnam, Philippines, Hong Kong, Taiwan), with expansion to Central America.

Tactics, Techniques, and Procedures (TTPs)

Attribution is based on multiple tradecraft overlaps with documented Lotus Blossom operations:

TTP Category	Observed Techniques
Initial Access	Leaked VPN credentials, phishing via OTT messaging platforms (Telegram, WhatsApp, Viber), supply chain compromise.
Execution	DLL sideloading using legitimate security vendor binaries (Bitdefender, Trend Micro).
Persistence	Service-based persistence, registry modification, scheduled tasks, multi-stage infection chains.
Defense Evasion	Living-off-the-land binaries, code obfuscation (Warbird), domain fronting for C2.
Command & Control	Custom backdoors (Sagerunex, Chrysalis), Cobalt Strike, domain fronting, encrypted communications.
Lateral Movement	Impacket framework for remote command execution and credential harvesting.
Collection	Extended dwell times (several months), patient reconnaissance, selective data exfiltration.

Recent Campaign Evolution (2025)

In 2025, Cisco Talos and other researchers documented Lotus Blossom deploying new variants of their proprietary Sagerunex backdoor across multiple industries, demonstrating continuous tool development. The Notepad++ operation represents their expansion into supply chain compromise as an initial access vector, complementing traditional spear-phishing and credential theft methodologies.

Kevin Beaumont's December 2025 investigation identified victim organizations with "interests in East Asia" experiencing "hands on keyboard recon activity," consistent with Lotus Blossom's espionage objectives and interactive post-exploitation behavior.

Indicators of Compromise (IOCs)

Network Indicators

• Malicious IP address: 95.179.213.0 (update redirection server)
• C2 domain: api.skycloudcenter.com (Chrysalis backdoor command and control)
• Compromised domain: notepad-plus-plus.org/update/getDownloadUrl.php (traffic interception point)

File-Based Indicators

• update.exe - NSIS installer containing malware components
• BluetoothService.exe - Renamed legitimate Bitdefender Submission Wizard binary
• log.dll - Malicious DLL performing sideloading attack
• BluetoothService (no extension) - Encrypted shellcode file containing Chrysalis backdoor
• ConsoleApplication2.exe - Warbird-protected Cobalt Strike loader
• conf.c - Custom Cobalt Strike beacon loader

Behavioral Indicators

• Notepad++ update processes (GUP.exe) communicating with non-official update servers
• BluetoothService.exe executing from non-standard directories (e.g., C:\ ProgramData)
• Legitimate security vendor binaries (Bitdefender, Trend Micro) loading suspicious DLLs from application directory
• Outbound HTTPS connections to api.skycloudcenter[.]com domain
• Service creation with names related to "Bluetooth" or similar system-sounding identifiers
• PowerShell or cmd.exe spawned as child processes of security vendor executables

Impact Assessment

Affected Populations

• Software: Notepad++ versions prior to 8.8.9 lacking update signature verification (released December 2025).
• Time window: Users who performed updates between June and December 2, 2025
• Targeting: Highly selective - only specific organizations with strategic intelligence value to China-linked espionage operations.
• Geographic focus: Organizations with interests in East Asia, consistent with Lotus Blossom's historical targeting.
• Known victims: At least three organizations identified by security researchers as of early December 2025.

Organizational Risk Factors

Organizations face elevated risk if they:

• Deploy Notepad++ across enterprise environments
• Operate in government, defense, telecommunications, manufacturing, or critical infrastructure sectors
• Maintain business operations or strategic interests in Southeast Asia
• Possess intellectual property or sensitive data of intelligence value to state-sponsored actors
• Lack robust endpoint detection and response (EDR) capabilities
• Have not updated Notepad++ to version 8.9.1 or later with signature verification enforcement

Potential Compromise Scenarios

If targeted and compromised, organizations may experience:

• Long-term persistent access by state-sponsored threat actors (demonstrated multi-month dwell times).
• Exfiltration of sensitive documents, intellectual property, and strategic communications
• Credential harvesting enabling lateral movement to critical systems
• Installation of additional backdoors and post-exploitation frameworks (Cobalt Strike)
• Compromise of connected systems through lateral movement using Impacket and stolen credentials.
• Potential disruption if attackers determine operational objectives require destructive actions

Threat Hunting Recommendations

Priority Detection Queries

Organizations should immediately implement threat hunting activities using the following approaches:

1. Historical Telemetry Analysis (June - December 2, 2025)

Search endpoint detection and response (EDR) and security information and event management (SIEM) logs for:

• Process creation events involving GUP.exe (Notepad++ updater) with network connections to non-official update servers
• File creation events for update.exe, BluetoothService.exe, log.dll, or ConsoleApplication2.exe
• Network connections from Notepad++ processes to IP 95.179.213.0 or domain api.skycloudcenter[.]com
• Service installations with suspicious names (Bluetooth-related from non-system directories)

2. DLL Sideloading Detection

Identify legitimate security vendor binaries loading suspicious DLLs:

• Bitdefender executables (especially Submission Wizard components) loading log.dll or other non-standard DLLs from application directories
• Trend Micro executables exhibiting similar sideloading behavior
• Monitor for signed executables loading unsigned DLLs from non-system paths

3. Behavioral Anomaly Detection

• Security vendor executables spawning shell processes (cmd.exe, powershell.exe)
• Processes with names mimicking system services (BluetoothService) executing from user-writable directories
• Outbound connections to domains mimicking legitimate cloud services (e.g., "skycloudcenter")
• Processes with unusually high entropy or Warbird-protected executable characteristics

4. Network Traffic Analysis

• DNS queries for api.skycloudcenter[.]com or similar typosquatting cloud service domains
• HTTPS connections from non-browser processes to recently registered domains
• Baseline software update mechanisms and alert on deviations (unexpected update sources)

Conclusion and Strategic Recommendations

The Notepad++ supply chain compromise demonstrates the sophisticated capabilities of state-sponsored APT groups to conduct patient, surgical cyber espionage operations through infrastructure-level attacks. Lotus Blossom's six-month campaign targeting organizations with strategic interests in East Asia represents a significant evolution in supply chain attack methodologies.

Strategic Recommendations for Leadership

• Immediate threat hunting: Allocate resources for comprehensive historical telemetry analysis using provided IOCs and hunting queries
• Software update governance: Establish enterprise policy mandating cryptographic signature verification for all software update mechanisms
• Supply chain risk program: Invest in formal supply chain security assessment capabilities and third-party vendor risk management
• Advanced detection capabilities: Ensure EDR and SIEM platforms have behavioral analytics and threat hunting capabilities to detect sophisticated APT tradecraft
• Threat intelligence investment: Subscribe to commercial threat intelligence services providing APT tracking and proactive IOC feeds
• Incident response readiness: Conduct tabletop exercises simulating supply chain compromise scenarios to validate detection and response capabilities

This incident underscores that even popular, well-maintained open-source software can become a vector for state-sponsored espionage when distribution infrastructure is compromised. A defense-in-depth approach incorporating cryptographic verification, behavioral detection, and proactive threat hunting is essential for defending against modern supply chain attacks.

Appendix A: MITRE ATT&CK Framework Mapping

Tactic	Technique	ID
Initial Access	Supply Chain Compromise	T1195.002
Initial Access	Valid Accounts	T1078
Execution	User Execution: Malicious File	T1204.002
Persistence	Create or Modify System Process	T1543
Defense Evasion	DLL Side-Loading	T1574.002
Defense Evasion	Obfuscated Files or Information	T1027
Defense Evasion	Signed Binary Proxy Execution	T1218
Command and Control	Application Layer Protocol: Web Protocols	T1071.001
Command and Control	Domain Fronting	T1090.004
Exfiltration	Exfiltration Over C2 Channel	T1041