Notepad++ Compromised by Chinese Hackers for Six Months

Notepad++, a popular text editor for Windows, experienced a significant security breach when its update infrastructure was compromised for six months by suspected Chinese state-sponsored hackers. This attack began in June and involved malicious actors intercepting and redirecting update traffic meant for notepad-plus-plus.org. The attackers were able to deliver backdoored versions of the software to select targets until Notepad++ regained control of its infrastructure in December.

The threat actors exploited insufficient update verification controls in older versions of Notepad++, specifically targeting the updater known as GUP. This allowed them to install a sophisticated backdoor, dubbed Chrysalis, which was described by Rapid 7 as a feature-rich tool with a wide array of capabilities. The attackers maintained access to internal services until December, indicating a prolonged threat.

Independent researcher Kevin Beaumont noted that organizations using Notepad++ reported security incidents, suggesting that the hackers gained direct control over devices. Beaumont’s suspicions were raised when version 8.8.8 introduced fixes to harden the updater against hijacking. The incident underscores the risks associated with software updates and the importance of robust verification processes.

Implications for Users and Organizations

This breach reveals critical vulnerabilities in software update mechanisms that can be exploited by sophisticated attackers. Users should be particularly cautious about the versions of Notepad++ they are using, as many may unknowingly run compromised versions. Beaumont warned that search engines are filled with advertisements for trojanized versions of Notepad++, further complicating the risk landscape.

Organizations managing Notepad++ installations should consider implementing strict controls, such as blocking access to notepad-plus-plus.org or monitoring the gup.exe process. While these measures may seem excessive, they reflect the need for heightened vigilance in software management.

Users are advised to ensure they are running the official version 8.9.1 or higher, installed directly from the official site. Monitoring for indicators of compromise is also crucial for those who suspect they may have been targeted during the attack.

• Notepad++: A widely used text editor for Windows that was compromised.
• Chrysalis: A sophisticated backdoor installed by attackers during the breach.
• GUP (Get Notepad++ Updater): The updater that was exploited to deliver malicious updates.