Notepad++ Supply Chain Hack Exposed, Researchers Publish IoCs and Custom Malware Analysis

Researchers have uncovered a sophisticated supply chain attack targeting Notepad++ users, revealing a meticulously orchestrated espionage campaign attributed to Lotus Blossom, a Chinese APT group active since 2009.

The investigation exposed a complex compromise of Notepad++ distribution infrastructure that delivered Chrysalis, a previously undocumented custom backdoor with extensive remote access capabilities and advanced evasion techniques.

Attack Infrastructure and Initial Compromise

The attack originated from IP address 95.179.213.0, where execution of notepad++.exe and GUP.exe (the Notepad++ updater) preceded the download of a malicious update.exe file.

This NSIS installer deployed a renamed Bitdefender Submission Wizard executable to the hidden %AppData%\Bluetooth directory, leveraging DLL sideloading for initial code execution.

When executed, it loaded a malicious log.dll that decrypted the Chrysalis backdoor using custom cryptographic algorithms combining linear congruential generators, FNV-1a hashing, and MurmurHash finalization techniques.

The Chrysalis backdoor operates as a feature-rich implant implementing 15 distinct command capabilities for comprehensive system compromise.

Configuration data encrypted with RC4 key “qwhvb^435h&*7” disclosed the command-and-control (C2) URL https://api.skycloudcenter.com/a/chat/s/70521ddf-a2ef-4adf-9cf0-6d8e24aaa821, which deliberately mimics Deepseek API formatting to blend with legitimate traffic.

The URL resolves to a Malaysian IP address, 61.4.102.97, while communications utilize a standard browser user agent to evade detection.

Command capabilities include spawning interactive reverse shells (4T), remote process execution (4V), comprehensive file operations (4Y, 4W, 4X), complete file transfer protocols (4c, 4d), self-removal functionality (4), and drive enumeration (4_).

A mutex, “Global\Jdhfv_1.0.1”, prevents multiple instances, while persistence is established through the creation of a Windows service or registry modifications.

Chrysalis implements sophisticated API hashing routines using FNV-1a and MurmurHash finalization, combined with position-dependent character transformation employing bit rotations and XOR operations.

The main module uses a hardcoded XOR key “gQ2JR&9;” applied through multiple encryption iterations.

Investigators discovered ConsoleApplication2.exe, a loader exploiting Microsoft’s undocumented Warbird code protection framework.

The loader invokes NtQuerySystemInformation with SystemCodeFlowTransition parameter (0xB9) to execute embedded Metasploit shellcode within Microsoft-signed binary memory.

This sophisticated technique downloads Cobalt Strike beacons from api.wiresguard.com/users/system, enabling secondary payload delivery.

Forensic analysis uncovered a renamed Tiny-C-Compiler executing malicious C source code from conf.c.

The shellcode employs rolling XOR decryption before transferring execution to Cobalt Strike HTTPS beacon using http-get endpoint api.wiresguard.com/update/v1 and http-post endpoint api.wiresguard.com/api/FileUpload/submit.

Attribution to Lotus Blossom is based on similarities with previous research, particularly the Bitdefender Submission Wizard DLL sideloading technique and shared infrastructure indicators.

Threat intelligence pivoting identified four additional loader variants sharing identical Cobalt Strike configurations and the same public key, indicating coordinated campaign activity.

Indicators of Compromise

Organizations should monitor for hidden %AppData% directories containing executables, NtQuerySystemInformation abuse patterns, and suspicious Deepseek-style API traffic to detect potential compromise.

The Chrysalis campaign demonstrates significant evolution in tradecraft, combining custom malware with commodity frameworks and rapid operationalization of public security research.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.