Notepad++ Hijacking Incident Deploying Backdoor, Linked to Lotus Blossom Group Campaign

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

Notepad++ developer Don Ho and security researchers at Rapid7 have said that the open-source text editor's software update mechanism was likely hijacked by a Chinese state-linked espionage group that Rapid7 believes may be Lotus Blossom (also known as Lotus Panda, Billbug, Bronze Elgin, Spring Dragon, and Thrip).

This Notepad++ hijacking campaign, occurring between June and December 2025, enabled an advanced persistent threat (APT) actor to deliver malicious payloads to specific users, compromising critical environments across the government, telecommunications, aviation, and media sectors.

Backdoor Deployed via DLL Sideloading

The attack involved compromising a shared hosting server to redirect update requests from targeted users to a malicious server controlled by the hackers. This redirection facilitated the delivery of a feature-rich, previously undocumented backdoor dubbed Chrysalis. 

Reports say the attackers “specifically targeted” Notepad++’s web domain to exploit a now-fixed flaw and redirect some users to an attacker-controlled server. However, it is yet unclear how the intrusion occurred. 

According to Rapid7's technical analysis, the threat actors employed complex evasion techniques, packaging the malware within an NSIS installer. The execution chain utilized DLL sideloading, abusing a legitimate, renamed Bitdefender Submission Wizard (BluetoothService.exe) to load a malicious DLL and decrypt the shellcode.

Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, added that attackers “filtered update requests by IP range, and hand-delivered trojanized installers to East Asian telecom and financial targets.”

Kaspersky’s SecureList today announced observing three different infection chains overall, designed to attack about a dozen machines, belonging to:

• Individuals in Vietnam, El Salvador, and Australia.
• A government organization in the Philippines.
• A financial organization in El Salvador.
• An IT service provider organization in Vietnam.

Implications for Software Supply Chain Security

This Notepad++ cyberattack was highly targeted, as “traffic from certain targeted users was selectively redirected to attacker-controlled” infrastructure. “By compromising the hosting infrastructure to deliver poisoned updates, the attackers likely sought to gain Remote Code Execution (RCE) on developer workstations,” Sectigo’s Jason Soroko said.

Since compromised updates were with the same privileges as legitimate software installations bypassed local controls, “reconnaissance, credential harvesting, lateral movement, persistence, or even data exfiltration became feasible inside the target networks based on Notepad++ usage and transmitted out of the organization based on subsequent update requests,” said Morey Haber, Chief Security Advisor at BeyondTrust.

While the vulnerability exploited for the redirection was patched in November 2025 and the attacker's access was reportedly terminated by December, organizations using Notepad++ should:

• Update to version 8.9.1 or later, 
• Adopt a zero-trust approach to software updates, 
• Ensure the integrity of the update channel,
• Vet hosting/CDN providers for security practices,
• Regular threat hunting around trusted paths and incident response readiness.

This month, Chinese spies were seen exploiting the Venezuela crisis to target U.S. officials. In April 2025, Lotus Panda cyberattacks targeted Southeast Asian governments, distributing a new variant of the custom Sagerunex backdoor.

Related

Spyware Vendor’s Pall Mall Claims Trigger Civil Society Backlash

Cyber Job Moves: New Appointments Across Threat Intelligence, Identity, and Critical Infrastructure

Alleged Data Breach Targets Spain’s Ministry of Science, Innovation, and Universities

State-Aligned Actors Exploit Unrest with RedKitten AI-Accelerated Campaign Targeting Iranian Protests

Open VSX Registry Deploys GlassWorm Malware via Four Malicious Extension Versions

Mandiant Reports ShinyHunters Extortion Tactics, Vishing, and SSO Compromise Target Cloud Environments 

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Subscribe for Free

Please enter a valid email address.

Most Popular

Spyware Vendor’s Pall Mall Claims Trigger Civil Society Backlash

Cyber Job Moves: New Appointments Across Threat Intelligence, Identity, and Critical Infrastructure

Alleged Data Breach Targets Spain’s Ministry of Science, Innovation, and Universities

State-Aligned Actors Exploit Unrest with RedKitten AI-Accelerated Campaign Targeting Iranian Protests

Open VSX Registry Deploys GlassWorm Malware via Four Malicious Extension Versions

Mandiant Reports ShinyHunters Extortion Tactics, Vishing, and SSO Compromise Target Cloud Environments 

Spyware Vendor’s Pall Mall Claims Trigger Civil Society Backlash

Cyber Job Moves: New Appointments Across Threat Intelligence, Identity, and Critical Infrastructure

Alleged Data Breach Targets Spain’s Ministry of Science, Innovation, and Universities

State-Aligned Actors Exploit Unrest with RedKitten AI-Accelerated Campaign Targeting Iranian Protests

Open VSX Registry Deploys GlassWorm Malware via Four Malicious Extension Versions

Mandiant Reports ShinyHunters Extortion Tactics, Vishing, and SSO Compromise Target Cloud Environments