{"id":10352,"date":"2026-02-03T10:03:44","date_gmt":"2026-02-03T10:03:44","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/03\/notepad-hack-detailed-along-with-the-iocs-and-custom-malware-used\/"},"modified":"2026-02-03T10:03:44","modified_gmt":"2026-02-03T10:03:44","slug":"notepad-hack-detailed-along-with-the-iocs-and-custom-malware-used","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/03\/notepad-hack-detailed-along-with-the-iocs-and-custom-malware-used\/","title":{"rendered":"Notepad++ Hack Detailed Along With the IoCs and Custom Malware Used"},"content":{"rendered":"

Notepad++ Hack Detailed Along With the IoCs and Custom Malware Used
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated espionage campaign attributed to the Chinese Advanced Persistent Threat (APT) group Lotus Blossom (also known as Billbug).<\/p>\n

The threat actors compromised the infrastructure hosting the popular text editor Notepad++<\/a> to deliver a custom, previously undocumented backdoor named \u201cChrysalis\u201d.<\/p>\n

This campaign, discovered by Rapid7 researcher Ivan Feigl, primarily targets organizations in the government, telecommunications, aviation, and critical infrastructure sectors across Southeast Asia and Central America.<\/p>\n

The investigation began with a security incident stemming from the execution of a malicious file named update[.]exe<\/em>, which was downloaded from a suspicious IP address (95.179.213[.]0<\/em>) following the legitimate execution of notepad++[.]<\/em>exe<\/em> and GUP[.]<\/em>exe<\/em> (the generic updater for Notepad++)<\/p>\n

Forensic analysis revealed that update[.]<\/em>exe<\/em> is an NSIS installer, a tool frequently abused by Chinese APTs for initial payload delivery.<\/p>\n

\n
\"\"
Attack Chain (Source: Rapid7)<\/figcaption><\/figure>\n<\/div>\n

Upon execution, the installer creates a hidden directory in the %AppData%<\/code> folder named \u201cBluetooth\u201d and drops several files, including BluetoothService.exe<\/code> and log.dll<\/code>.<\/p>\n

The executable BluetoothService.exe<\/code> is actually a renamed, legitimate Bitdefender Submission Wizard binary. The attackers utilize this legitimate file to perform DLL sideloading, forcing it to load the malicious log.dll<\/code> instead of the genuine library.<\/p>\n

The Chrysalis Backdoor<\/strong><\/h2>\n

Once loaded, log.dll<\/code> decrypts and executes a shellcode payload the Chrysalis backdoor. This malware is a sophisticated, feature-rich implant designed for long-term persistence rather than simple \u201csmash-and-grab\u201d operations, Rapid7 observed<\/a>.<\/p>\n

Chrysalis employs several advanced evasion techniques:<\/p>\n