Notepad++ Attack Breakdown Reveals Sophisticated Malware and Actionable IoCs
An espionage campaign attributed to the Chinese APT group Lotus Blossom, active since 2009, has been uncovered, revealing a sophisticated compromise of the Notepad++ distribution infrastructure. This breach delivered Chrysalis, a previously undocumented…
An espionage campaign attributed to the Chinese APT group Lotus Blossom, active since 2009, has been uncovered, revealing a sophisticated compromise of the Notepad++ distribution infrastructure. This breach delivered Chrysalis, a previously undocumented custom backdoor with extensive remote access capabilities.
The attack initiated at IP address 95.179.213.0, where the execution of notepad++.exe and GUP.exe preceded the download of a malicious update.exe file. This file, an NSIS installer, deployed a renamed Bitdefender Submission Wizard executable to the hidden %AppData%\Bluetooth directory for DLL sideloading. Upon execution, it loaded a malicious log.dll that decrypted the Chrysalis backdoor using custom algorithms.
Execution diagram of update.exe (Source: Rapid7)
The Chrysalis backdoor is a feature-rich implant with 15 distinct command capabilities. Configuration data encrypted with RC4 key "qwhvb^435h&*7" disclosed the C2 URL https://api.skycloudcenter.com/a/chat/s/70521ddf-a2ef-4adf-9cf0-6d8e24aaa821 , which mimics Deepseek API formatting. The URL resolves to Malaysian IP address 61.4.102.97, and the backdoor communicates using a standard browser user agent.
Spawning interactive reverse shells Remote process execution File read/write operations Complete file transfer protocols Self-removal functionality Drive enumeration
A mutex "Global\Jdhfv_1.0.1" prevents multiple instances, and persistence is established through Windows service creation or registry modifications.
This breach delivered Chrysalis, a previously undocumented custom backdoor with extensive remote access capabilities.
Chrysalis uses API hashing routines with FNV-1a and MurmurHash finalization, and string obfuscation involves bit rotations and XOR operations. The main module employs a hardcoded XOR key "gQ2JR&9;" applied through XOR, addition, and subtraction operations.
ConsoleApplication2.exe, a loader, exploits Microsoft's undocumented Warbird code protection framework. This involves executing embedded Metasploit block_api shellcode within Microsoft-signed binary memory. The technique downloads Cobalt Strike beacons from api.wiresguard.com/users/system .
Forensic analysis revealed a renamed Tiny-C-Compiler executing malicious C source code from conf.c , with shellcode using rolling XOR decryption before transferring execution to Cobalt Strike HTTPS beacon.
Execution flow followed by conf.c and other loaders (Source: Rapid7)
Threat intelligence identified four additional loader variants with identical Cobalt Strike configurations, indicating coordinated campaign activity. Attribution to Lotus Blossom is based on shared techniques and infrastructure indicators.
update.exe a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9 [NSIS.nsi] 8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e BluetoothService.exe 2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924 log.dll 3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad conf.c f4d829739f2d6ba7e3ede83dad428a0ced1a703ec582fc73a4eee3df3704629a
95.179.213.0 api[.]skycloudcenter[.]com api[.]wiresguard[.]com 61.4.102.97
Based on reporting by GBHackers.