CERT-UA has identified a new malware campaign by UAC-0099, a Russia-aligned threat actor group, that distributes MATCHBOIL.V2 through a counterfeit Notepad++ plugin.

The attack exploits user trust in legitimate development tools. UAC-0099 packages malware as an authentic Notepad++ extension, likely distributed through compromised or fake download channels. When users install the fake plugin, MATCHBOIL.V2 executes on their Windows systems.

MATCHBOIL.V2 represents an evolution of the group's malware arsenal. UAC-0099 has demonstrated sophistication in previous campaigns, notably leveraging CVEs in WinRAR to establish initial access. This plugin-based approach follows a similar logic: targeting developers and technical users who rely on Notepad++ for coding work.

The distribution method is straightforward but effective. Users download what appears to be a legitimate plugin, then execute it with standard user privileges. The malware then establishes persistence and enables follow-on compromise.

Windows administrators should enforce strict plugin installation policies. Organizations should restrict software downloads to official sources only. Notepad++ maintains a centralized plugin registry. Users installing extensions outside this registry face elevated risk. CERT-UA recommends verifying all plugin sources before installation.

For defenders, MATCHBOIL.V2 detection requires behavioral analysis and network monitoring. The malware likely establishes command-and-control communications after execution. Standard endpoint detection tools should flag suspicious Notepad++ child process activity or unexpected network connections.

UAC-0099 continues targeting organizations with geopolitical interest to Russian operations, particularly in Eastern Europe. The group's willingness to adapt distribution methods indicates sustained operational capability and resource allocation. This campaign demonstrates threat actors recognize developer tools as effective infection vectors due to the privileged access developers maintain on enterprise networks