Security AffairsPierluigi Paganini
Ukraine Hit by Fake Notepad++ Plugin in UAC-0099 Phishing Attack
UAC-0099, a Russia-aligned threat actor, is targeting Ukrainian organizations by delivering malware through a fraudulent Notepad++ plugin as part of a phishing campaign. The attack begins with a phishing email containing a disguised image link that leads to a ZIP file. Inside, a VBScript file masquerades as a PDF, triggering the download of a malicious DLL and other files.
The malicious DLL, named LUNCHPOKE, installs a loader, BURNYBEAR, which can execute further payloads, including a modified loader known as MATCHBOIL.V2. This campaign underscores the importance of updating software to mitigate vulnerabilities exploited by such threat actors.
Story timeline UAC-0099
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 24 Jul · 07:07 UTC | The Hacker News | Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in Espionage Attack |
| Fri 24 Jul · 11:00 UTC | Security Affairs | Ukraine Hit by Fake Notepad++ Plugin in UAC-0099 Phishing Attack (this article) |
| Tue 1 Sep · 08:56 UTC | The Hacker News | UAC0099 malware uses nuclear prompts to hijack AI systems |
| Fri 11 Sep · 18:12 UTC | Dark Reading | Russia-Aligned Hackers Probe AI Safety Guardrails with Malware |
| Thu 8 Oct · 13:27 UTC | Infosecurity | Russia Aligned UAC-0099 Refines MATCHBOIL Malware to Target Ukraine |
| Thu 8 Oct · 18:12 UTC | Dark Reading | Russia Aligned Hackers Refine MatchBoil Malware to Spy on Ukraine’s Key Sectors |