A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++.
The attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to users of the open-source editor, according to new findings from Rapid7.
The development comes shortly after Notepad++ maintainer Don Ho said that a compromise at the hosting provider level allowed threat actors to hijack update traffic starting June 2025 and selectively redirect such requests from certain users to malicious servers to serve a tampered update by exploiting insufficient update verification controls that existed in older versions of the utility.
The weakness was plugged in December 2025 with the release of version 8.8.9. It has since emerged that the hosting provider for the software was breached to perform targeted traffic redirections until December 2, 2025, when the attacker's access was terminated. Notepad++ has since migrated to a new hosting provider with stronger security and rotated all credentials.
Rapid7's analysis of the incident has uncovered no evidence or artifacts to suggest that the site's plugin or updater-related mechanisms were exploited to distribute malware.
"The only confirmed behavior is that execution of 'notepad++.exe' and subsequently 'GUP.exe' preceded the execution of a suspicious process 'update.exe' which was downloaded from 95.179.213.0," security researcher Ivan Feigl said.
"Update.exe" is a Nullsoft Scriptable Install System (NSIS) installer that contains multiple files -
- An NSIS installation script
- BluetoothService.exe, a renamed version of Bitdefender Submission Wizard that's used for DLL side-loading (a technique widely used by Chinese hacking groups)
- BluetoothService, encrypted shellcode (aka Chrysalis)
- log.dll, a malicious DLL that's sideloaded to decrypt and execute the shellcode
Chrysalis is a bespoke, feature-rich implant that gathers system information and contacts an external server ("api.skycloudcenter[.]com") to likely receive additional commands for execution on the infected host.
The command-and-control (C2) server is currently offline. However, a deeper examination of the obfuscated artifact has revealed that it's capable of processing incoming HTTP responses to spawn an interactive shell, create processes, perform file operations, upload/download files, and uninstall itself.
"Overall, the sample looks like something that has been actively developed over time," Rapid7 said, adding it also identified a file named "conf.c" that's designed to retrieve a Cobalt Strike beacon by means of a custom loader that embeds Metasploit block API shellcode.
One such loader, "ConsoleApplication2.exe" is noteworthy for its use of Microsoft Warbird, an undocumented internal code protection and obfuscation framework, to execute shellcode. The threat actor has been found to copy and modify an already existing proof-of-concept (PoC) published by German cybersecurity company Cirosec in September 2024.
Rapid7's attribution of Chrysalis to Lotus Blossom (aka Billbug, Bronze Elgin, Lotus Panda, Raspberry Typhoon, Spring Dragon, and Thrip) based on similarities with prior campaigns undertaken by the threat actor, including one documented by Broadcom-owned Symantec in April 2025 that involved the use of legitimate executables from Trend Micro and Bitdefender to sideload malicious DLLs.
"While the group continues to rely on proven techniques like DLL side-loading and service persistence, their multi-layered shellcode loader and integration of undocumented system calls (NtQuerySystemInformation) mark a clear shift toward more resilient and stealth tradecraft," the company said.
"What stands out is the mix of tools: the deployment of custom malware (Chrysalis) alongside commodity frameworks like Metasploit and Cobalt Strike, together with the rapid adaptation of public research (specifically the abuse of Microsoft Warbird). This demonstrates that Billbug is actively updating its playbook to stay ahead of modern detection."
Kaspersky Observes 3 Infection Chains
Kaspersky, in its own breakdown of the Notepad++ incident, said it observed three different infection chains that were designed to target about a dozen machines belonging to individuals located in Vietnam, El Salvador, and Australia, a government organization located in the Philippines, a financial organization located in El Salvador, and an IT service provider organization located in Vietnam.
"Over the course of four months, from July to October 2025, attackers who have compromised Notepad++ have been constantly rotating C2 server addresses used for distributing malicious updates, the downloaders used for implant delivery, as well as the final payloads," security researchers Georgy Kucherin and Anton Kargin said.
The company said it did not detect any payloads being deployed starting from November 2025. The details of the three infection sequences are below -
Chain #1 (Between late July and early August 2025)
Attackers were found to deploy a malicious Notepad++ update hosted at "45.76.155[.]202/update/update.exe," which was then launched by the legitimate Notepad++ updater process WinGUp ("gup.exe"). The executable, an NSIS installer, was used to send system information to a temp[.]sh URL by executing a series of shell commands (whoami and tasklist). This behavior was described by a user named "soft-parsley" on the Notepad++ community forums in October 2025.
Like in the case of "update.exe" documented by Rapid7, the "update.exe" used in this chain leveraged DLL side-loading by abusing a legitimate binary associated with ProShow software ("ProShow.exe") to deploy two shellcodes: one that's not meant to be executed and functioned as a distraction mechanism, while the second shellcode decrypted a Metasploit downloader payload that retrieves a Cobalt Strike beacon shellcode from a remote URL.
Chain #2 (Between the middle and the end of September 2025)
The malicious update continued to be delivered via "45.76.155[.]202/update/update.exe," while the "update.exe" NSIS installer featured slight tweaks to collect more system information (whoami, tasklist, and netstat) and deliver a completely different set of payloads, including a Lua script that's engineered to execute shellcode. The launched shellcode was a Metasploit downloader that drops a Cobalt Strike beacon.
A subsequently observed "update.exe" variant towards the end of September 2025 also harvested the results of the systeminfo shell command alongside whoami, tasklist, and netstat. Another version of the binary changed the system information upload URL to self-dns.it[.]com/list, along with the URL used by the Metasploit downloader and Cobalt Strike Beacon C2 server.
Chain #3 (October 2025)
This infection chain altered the NSIS installer distribution URL to "45.32.144[.]255/update/update.exe" and initiated the same sequence of events described by Rapid7 above. What's common to all three sets of attacks is the fact that the Beacons are loaded through a Metasploit downloader shellcode.
Then, starting mid-October 2025, the attackers began to propagate the installer via three different URLs to launch a combination of both #2 and #3 execution chains -
- 95.179.213[.]0/update/update.exe
- 95.179.213[.]0/update/install.exe
- 95.179.213[.]0/update/AutoUpdater.exe
The compromise of Notepad++'s update infrastructure is the latest example of how the software ecosystem has increasingly become the target of supply chain attacks in recent years. In breaching the mechanism used to distribute updates, it enabled the attackers to selectively break into machines of high-profile organizations across the world, the Russian cybersecurity vendor noted.
"The variety of infection chains makes detection of the Notepad++ supply chain attack quite a difficult and at the same time creative task," Kaspersky said. "The attackers made an effort to avoid losing access to this infection vector — they were spreading the malicious implants in a targeted manner, and they were skilled enough to drastically change the infection chains about once a month."
