State-sponsored attackers hijacked Notepad++’s update mechanism from June to December 2025, delivering targeted malware via a compromised hosting server.This infrastructure-level breach targeted high-value users in East Asia, exposing risks in software update chains.
The Breach Mechanics
Attackers infiltrated the shared hosting provider for notepad-plus-plus.org, gaining control over the getDownloadUrl.php endpoint.They selectively redirected update requests from telecom and financial sectors, serving trojanized installers that performed system reconnaissance—scanning processes, networks, and users—before exfiltrating data via curl to temp[.]sh domains. Unlike broad attacks, this was precise, evading detection for months through credential persistence even after direct server access ended on September 2, 2025.
Key Timeline
- June 2025: Initial hosting server compromise begins.
- September 2, 2025: Direct access lost, but update redirects continue via stolen credentials.
- November 18, 2025: v8.8.8 shifts updates to GitHub releases.
- December 2, 2025: Hosting provider terminates all attacker access.
- December 9, 2025: v8.8.9 introduces mandatory signature verification.
Malware and Tactics
Trojanized GUP.exe spawned AutoUpdater.exe, mimicking legitimate behavior but adding unauthorized curl exfiltration and recon scripts.Older versions pre-v8.8.9 lacked signature enforcement, aligning with MITRE ATT&CK T1195.002 (Supply Chain Compromise) and T1557.002 (Adversary-in-the-Middle).Indicators point to Chinese APT groups, with victims including Vietnamese IT firms and Philippine government entities.
Implications for Cybersecurity
This incident highlights hosting provider risks for open-source tools, urging SBOMs and runtime integrity checks. No mass infections occurred, but it underscores selective targeting in supply chains.
Immediate Actions
- Upgrade to Notepad++ v8.8.9+ and validate GlobalSign signatures on downloads from notepad-plus-plus.org or GitHub
- Scan for Temp directory artifacts, anomalous curl traffic, or self-signed certs; use EDR for process enumeration
- Enterprises: Audit update mechanisms, enforce HSTS, and monitor for temp[.]sh C2s.
