Security researchers from Rapid7 and Kaspersky have attributed a targeted supply-chain attack against Notepad++ to a China-aligned threat group known as Lotus Blossom (aka Billbug / Lotus Panda / Bronze Elgin).
⚙️ What happened
- Attackers breached the hosting provider, not the Notepad++ codebase itself
- Update traffic was selectively hijacked between June–December 2025
- Certain users were redirected to malicious update servers
- Older Notepad++ versions lacked sufficient update verification
- The issue was fixed in Notepad++ 8.8.9 (Dec 2025)
🧬 Malware deployed
- A previously undocumented backdoor called Chrysalis
- Delivered via a tampered NSIS update installer
- Used DLL side-loading with legitimate binaries (Bitdefender / Trend Micro)
- Multi-stage loader capable of:
- Interactive shell access
- File upload/download
- Process execution
- Self-removal
🛰️ Advanced tradecraft observed
- Custom shellcode loaders
- Use of Microsoft Warbird (undocumented internal obfuscation framework)
- Integration with Metasploit and Cobalt Strike
- Monthly rotation of C2 infrastructure and infection chains
🌍 Victim targeting
- Confirmed victims across Vietnam, Australia, El Salvador, Philippines
- Government, finance, and IT service providers affected
- Attacks were highly selective, not mass-distribution
🔐 Why this matters
This incident reinforces how software update channels remain one of the most effective attack vectors for state-sponsored cyber-espionage, allowing attackers to compromise trusted tools used daily by developers and enterprises worldwide.
