Quick Summary
A supply chain attack on Notepad++ has been attributed to the Chinese state-sponsored group Lotus Blossom, targeting specific organizations in Vietnam, El Salvador, and Australia. The attackers exploited the Notepad++ update mechanism to distribute a sophisticated backdoor named ‘Chrysalis’ over several months, from July to October 2025. This incident highlights significant risks for targeted users, including a government organization in the Philippines and a financial organization in El Salvador, emphasizing the need for robust security measures.
The Securityish Brief
Rapid7 researchers have linked the recent compromise of the Notepad++ update mechanism to the Chinese state-sponsored group known as Lotus Blossom. This attack specifically targeted individuals in Vietnam, El Salvador, and Australia, as well as organizations such as a government entity in the Philippines and a financial institution in El Salvador. The attackers utilized a malicious payload (update.exe) that was delivered through an NSIS installer, which sideloaded a DLL (log.dll) to execute a custom backdoor called ‘Chrysalis’.
The ‘Chrysalis’ backdoor is notable for its complexity and permanence, employing legitimate binaries to sideload a crafted DLL, making detection challenging. The attackers also used various execution chains, including one that involved a Lua script to launch a Metasploit downloader to retrieve a Cobalt Strike Beacon payload. Over a four-month period, the attackers rotated command and control (C2) server addresses and the payloads used for delivery.
This incident is significant as it demonstrates the evolving tactics of state-sponsored groups, particularly in targeting specific organizations for espionage. The Notepad++ maintainer has since implemented security measures to verify the integrity of updates and migrated the website to a more secure hosting provider.
Implications for Users and Organizations
While most Notepad++ users were not affected, the attack underscores the importance of vigilance among targeted organizations. Users should be aware of the potential for sophisticated attacks that exploit trusted software update mechanisms. Organizations should monitor for indicators of compromise shared by Rapid7 and Kaspersky to assess their exposure.
The use of advanced techniques like DLL sideloading and custom backdoors highlights the need for enhanced detection capabilities. Organizations should consider implementing more robust security practices, including regular audits of software and update mechanisms.
As cyber threats continue to evolve, maintaining strong security hygiene and being proactive in monitoring for unusual activity is essential for all users and organizations.
Key Takeaways
- Regularly check for updates from trusted sources and verify their integrity before installation.
- Monitor for indicators of compromise related to the Notepad++ supply chain attack.
- Implement robust security practices, including regular audits of software and update mechanisms.
- Educate employees about the risks of sophisticated cyber threats and the importance of vigilance.
- Consider migrating to more secure hosting providers if managing critical software updates.
Key Terms & Concepts
- Lotus Blossom: In this article, Lotus Blossom refers to a Chinese state-sponsored group known for targeting organizations for espionage.
- Chrysalis: Chrysalis is a sophisticated backdoor identified in the Notepad++ supply chain attack, capable of various malicious activities.
- DLL sideloading: DLL sideloading is a technique where a malicious DLL is executed by exploiting a legitimate application, making detection difficult.
- Cobalt Strike Beacon: Cobalt Strike Beacon is a payload used for command and control communication in cyber attacks.
Read the original article here: https://www.helpnetsecurity.com/2026/02/03/notepad-supply-chain-attack-iocs-targets/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
