Notepad++ Hack Detailed Along With the IoCs and Custom Malware Used
An espionage campaign, attributed to the Chinese Advanced Persistent Threat (APT) group known as Lotus Blossom or Billbug, has been identified. The group compromised the infrastructure hosting the text editor Notepad++ to deliver a custom backdoor named…
An espionage campaign, attributed to the Chinese Advanced Persistent Threat (APT) group known as Lotus Blossom or Billbug, has been identified. The group compromised the infrastructure hosting the text editor Notepad++ to deliver a custom backdoor named "Chrysalis."
The campaign, discovered by Rapid7, targets sectors including government, telecommunications, aviation, and critical infrastructure in Southeast Asia and Central America. The investigation originated from a security incident involving a malicious file, update[.]exe , downloaded after executing legitimate Notepad++ files.
Forensic analysis indicates that update[.]exe is an NSIS installer, widely used by Chinese APTs for payload delivery. Upon execution, this installer creates a hidden directory in the %AppData% folder named "Bluetooth," dropping files like BluetoothService.exe and log.dll . BluetoothService.exe is a legitimate Bitdefender Submission Wizard binary, used for DLL sideloading to load the malicious log.dll .
Once loaded, log.dll decrypts and executes the Chrysalis backdoor, designed for long-term persistence. Chrysalis uses advanced evasion techniques including:
Custom Encryption: Employs a linear congruential generator for decryption. API Hashing: Resolves Windows APIs using a custom hashing algorithm to evade detection. C2 Communication: Communicates with a Command and Control (C2) server over HTTPS, mimicking legitimate traffic.
An espionage campaign, attributed to the Chinese Advanced Persistent Threat (APT) group known as Lotus Blossom or Billbug, has been identified.
Chrysalis supports 16 commands, including:
Interactive Shell: Spawns a reverse shell via cmd.exe . File Operations: Allows reading, writing, and deleting files. Process Execution: Facilitates launching remote processes. Self-Removal: Removes persistence artifacts and deletes itself.
A loader variant, ConsoleApplication2.exe , uses Microsoft Warbird to hide its execution flow. It leverages the NtQuerySystemInformation system call with the undocumented SystemCodeFlowTransition class, enabling kernel-level execution of encrypted data.
This approach bypasses user-mode hooks and standard EDR monitoring, indicating advancements in Billbug's techniques.
File Name SHA-256 Hash Description update.exe a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9 Malicious NSIS Installer BluetoothService.exe 2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924 Renamed Bitdefender Submission Wizard log.dll 3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad Malicious DLL
Indicator Type Context 95.179.213.0 IP Address Host for update.exe download api.skycloudcenter.com Domain Chrysalis Backdoor C2
ATT&CK ID Name T1204.002 User Execution: Malicious File T1574.002 DLL Side-Loading
Based on reporting by Cyber Security News.