Notepad++ supply chain attack

The open-source text editor Notepad++ has confirmed that Chinese state-sponsored hackers hijacked its auto-update mechanism for six months, selectively pushing malware to targeted users.

What actually happened

The attack, which ran from June to December 2025, wasn't a typical software compromise. Rather than hacking Notepad++'s code or tricking developers into including malicious packages, the attackers went after the hosting infrastructure itself.

Here's the chain of events:

1. June 2025: Attackers compromise a shared hosting server used by Notepad++
2. June-September: Malicious actors intercept update traffic, redirecting specific users to attacker-controlled servers
3. 2nd September: A routine kernel and firmware update briefly kicks the attackers out
4. September-December: Attackers regain access using previously stolen credentials that were never rotated
5. 2nd December: The hosting provider finally detects and terminates the breach
6. December 2025: Security researcher Kevin Beaumont publicly reveals he knows of three organisations compromised via Notepad++ processes

The attack used selective targeting. The attackers carefully chose which users received poisoned updates, routing only certain traffic to their malicious servers. If you weren't on their list, you got the legitimate update.

Who's behind it

Multiple independent security researchers have attributed the attack to Lotus Blossom (also tracked as Raspberry Typhoon, Bilbug, Spring Dragon, and Violet Typhoon/APT31). The article identifies Lotus Blossom as a Chinese state-sponsored espionage group active since 2009.

Rapid7's investigation found the campaign targeted:

• Government organisations
• Telecommunications companies
• Aviation sector
• Critical infrastructure
• Media organisations

The targets predominantly had interests in East Asia, aligning with Lotus Blossom's historical focus on Southeast Asian espionage.

The malware: Chrysalis

Rapid7 researchers uncovered a previously undocumented custom backdoor they named "Chrysalis".

The infection chain:

1. User's Notepad++ requests an update via GUP.exe (WinGUp updater)
2. Traffic redirects to attacker infrastructure at 95.179.213.0
3. The user downloads "update.exe", an NSIS installer package
4. The installer drops three files into %AppData%\Bluetooth
5. A legitimate Bitdefender executable loads a malicious DLL (sideloading)
6. The DLL decrypts and executes the Chrysalis backdoor

The backdoor features:

• Custom API hashing to evade detection
• RC4-encrypted configuration containing C2 details
• Layered obfuscation throughout
• C2 communications disguised to look like DeepSeek API chat traffic

Why this matters for IT leaders

Notepad++ isn't niche software. It has tens of millions of users worldwide and has been around for over two decades. It is used by developers, sysadmins, security researchers, and anyone dealing with code or config files.

This attack mirrors the SolarWinds breach of 2019-2020, where Russian intelligence services compromised software updates to access multiple US government agencies. Both attacks used a trusted update mechanism to deliver malware to targets.

The implications:

1. Supply chain attacks are increasing. Attackers can compromise a trusted supplier to reach a target.
2. Shared hosting is a risk. The attackers compromised the hosting provider rather than Notepad++'s code.
3. Credential rotation matters. The attackers regained access after a server update because old credentials had not changed.
4. Update verification matters. Older Notepad++ versions did not adequately verify update authenticity.

What Notepad++ has done

Developer Don Ho has taken several steps:

• Migrated to a new hosting provider with stronger security practices
• Rotated all credentials that could have been compromised
• Version 8.8.9 now verifies installer certificates and signatures
• Update XML is cryptographically signed
• Version 8.9.2 (expected March 2026) will enforce mandatory certificate signature verification

Immediate actions for your organisation

1. Update Notepad++ immediately

Download version 8.9.1 or later from GitHub. Check your current version in the Help menu under About. Anything before 8.8.9 is potentially vulnerable.

2. Hunt for compromise indicators

Watch for:

• Unexpected files in %AppData%\Bluetooth
• Processes named "BluetoothService.exe" that aren't legitimate Bluetooth services
• Network connections to unusual domains from Notepad++ processes
• Execution of "update.exe" following Notepad++ or GUP.exe activity

3. Review your software supply chain

Ask yourself:

• What tools on your network auto-update?
• Do they verify signatures?
• Are you monitoring update traffic?

4. Consider policy changes

• Application whitelisting for critical systems
• Network segmentation to limit blast radius
• EDR solutions that monitor for DLL sideloading
• Regular audits of third-party software behaviour

The bigger picture

Disabling automatic updates in response can leave software unpatched. Update authenticity and timely patching both need attention.

The real solution is verified, signed updates with proper certificate checking. Notepad++ is implementing this now, but it took a six-month breach to get there.

For IT leaders, this reinforces the case for:

• Zero-trust architecture
• Comprehensive endpoint detection and response (EDR)
• Network traffic analysis
• Regular security audits of third-party software

The reported campaign combined infrastructure compromise with selective targeting over several months.

Update Notepad++ and audit which other tools update without adequate verification. If supply chain risk is a concern for your organisation, my security consulting practice covers vendor risk, software supply chain assessment, and incident response planning.

Supply chain attacks also affect other development and business tools. For more on related topics, read about slopsquatting and AI supply chain attacks, browser extension security risks, and non-human identity security.

---

Sources

• BleepingComputer: Notepad++ update feature hijacked by Chinese state hackers
• Rapid7: The Chrysalis Backdoor Analysis
• TechCrunch Report
• Notepad++ GitHub Releases