Russia-linked UAC-0099 cyber threat group has changed its attack techniques and is now using new malware called Lunchpoke and Burnybear, as well as an updated version of Matchboil, according to a new security alert from Ukraine’s computer emergency response team CERT-UA.
The attack usually starts with a phishing email containing an image. When the image is clicked, the victim is directed to a file-sharing service where a ZIP archive is downloaded. The archive contains a disguised VBS script with double file extension that makes the script appear as a PDF file.
When opened, the script downloads a fake PDF document and a copy of Notepad++ 8.8.3. The attackers hide a malicious DLL file (NppExport.dll) inside the plugin folder. The archive also contains an executable file WinRAR (winrar.exe).
Notepad++ normally loads plugins at startup, which allows the malware to execute automatically. The malicious DLL installs additional malware, creates scheduled tasks for persistence, and downloads more malicious files.
CERT-UA also noted that if Burnybear is launched incorrectly, it starts a process that consumes large amounts of computer memory and CPU resources.
The updated Matchboil malware continues to communicate with command-and-control (C&C) servers and download more malicious programs. Unlike earlier versions, it now uses WinRAR to extract downloaded files and can retrieve the utility from Dropbox if it is missing.
The agency also noted that “according to the Notepad++ development team, loading plugins in the form of libraries is an intended feature of the software and an inherent aspect of its architecture. As a result, there is an ongoing dispute regarding the NIST NVD entry identified as CVE-2025-56383.” This is why CERT-UA does not reference CVE-2025-56383 directly, but mentions it to make it easier to find related information.