If you read nothing else, read this

Stop. Don’t. Panic.

There is a lot of panic surrounding this popular open source tool, and potential risks as it tends to be used by Systems Administrators, making it commonly installed on sensitive machines.

You have three things to consider

Are you frequently targeted by Nation State Actors? If no, you likely aren’t impacted.
If you are running the latest build (8.9.1), WinGup has been secured reducing the risk.
If you’ve checked your environment against known IOC hashes from popular threat groups and come up empty, you’re probably good.

Notepad++ incident summary

Risk Evaluation

The key takeaway is the majority of consumers of the product were not affected, let alone targeted. This attack was most similar to a SPEAR phishing attack. If your network/dns/company wasn’t on the list you weren’t in scope. The attack group likely wanted to avoid detection as long as possible, and they largely succeeded in that goal.

Notepad++ Team

“This was a highly selective attack by a state-sponsored group targeting specific high-value organizations. Security researchers confirmed that the vast majority of Notepad++ users were never affected” - Important Clarification: Notepad++ Security Incident | Notepad++

So you’re probably fine. Cool. But “probably fine” isn’t where something like this ends. The ripple effects of something like this almost always hit harder than the attack itself.

Attack Overview

There have been a ton of in depth reviews on the attack. I want to simplify this attack into something compressed and easier to digest, first a simple picture.

Simplified attack flow

What was compromised in this image, is the Update server, where in simple terms a filter “are you coming from a known list” - if so, let me give you something bad.

Phase 1 - Capture the Server

In June 2025 a threat actor group, compromised the online update server, responsible for directing requests made by the self-updater tool (WinGup.exe). Regardless of depth of ownership, the server is owned this means, that for all requests coming in all things are possible.

Phase 2 - Redirect - SPECIFIC requests.

From June until December 2nd, 2025 (ish), when certain requests were made, some were known to be re-directed to download malicious content, including the IOC’s mentioned in numerous blogs.

Phase 3 - The Known Unknown

September 2nd 2025 the attackers lost access to the compromised server, but retained access to internal Notepad++ services.

November 10th 2025 - the attackers stopped being seen by researchers, but retained access to certain credentials.

NotePad++ Team

Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers.

None of the involved researches see proof of anything happening between November 10th, and December 2nd, so it’s possible that no requests were routed during this time.

December 2nd 2025 - all possible access is presumed to be revoked by the notepad++ team.

Credit Nash Pherson

Thank you for reading this closely and pointing out my date mess up here, prompting me to go back and re-write it again after I had gotten some actual sleep. I think I have it correct now. I re-wrote this section three or for times between meetings originally and made an oops.

Phase 3 - Do bad things to people who downloaded those files

When files were downloaded, this then enabled the attackers a way to directly manipulate the end impacted devices.

What does this mean long term?

I haven’t seen too much of it just yet, but I am concerned about the secondary and tertiary impact of a successful attack like this. We saw it with Crowdstrike, and with Solarwinds, where it introduced further friction in the software acquisition process when it comes to vetting and implementing software.

If you think the outcome from this is any different think again. Companies are going to be forced to aggressively look internally at their solutions, look aggressively at their infrastructure and the tools they rely on and make some hard decisions when it comes to their favorite tools.

OSS

At the end of the day Notepad++ is a massive, free open source project. Want to compile it yourself and update it yourself, well here you go read the license and build it yourself.

notepad-plus-plus/LICENSE at master · notepad-plus-plus/notepad-plus-plus

What’s unsaid here, is that a product like Notepad++ installed on millions of machines developed and maintained - FOR FREE - is not going to have an enterprise team of security specialists, monitoring things round the clock.

They are not going to have, a cyberteam, monitoring every single pull request, and evaluating the security risk in product on every single new feature or plugin.

This where companies, and individuals, have to help contribute to maintain these projects, or eventually the projects WILL get leveraged in future attacks. They WILL be the weakest link, and or the tools WILL stop existing.

Get it in your heads, we got lucky

Brutal honesty time, and look in the mirror. As an industry, we got lucky.

This is a tool that system administrators use everywhere.

The attackers only targeted a few people.

Now, it’s known to be effective.

The next time, the rest of the world might not be left out of the party.

Stay patch current, keep constant vigilance for new behaviors in your environment with EDR/XDR platforms and maybe, just maybe, consider throwing $20 at the open source tools you use on a daily basis.

References

https://notepad-plus-plus.org/assets/data/IoCFromFormerHostingProvider.txt https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ https://securelist.com/notepad-supply-chain-attack/118708/

Malicious IPs used to connect to the server from the hosting provider, are these connecting to your environment per the hosting provider:

212[.]30[.]60[.]8 94[.]190[.]195[.]237 146[.]70[.]113[.]105 194[.]114[.]136[.]211 8[.]216[.]128[.]215 116[.]251[.]216[.]119 217[.]69[.]5[.]44 188[.]166[.]199[.]140 2001[:]19f0[:]6801[:]950[:]5400[:]5ff[:]feb2 61[.]4[.]102[.]97 172[.]233[.]246[.]7

Evaluate the IOC’s - Per Rapid 7 Message from Rapid7 Chat

File	SHA-256
update.exe	a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9
[NSIS.nsi]	8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e
BluetoothService.exe	2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924
BluetoothService	77bfea78def679aa1117f569a35e8fd1542df21f7e00e27f192c907e61d63a2e
log.dll	3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad
u.bat	9276594e73cda1c69b7d265b3f08dc8fa84bf2d6599086b9acc0bb3745146600
conf.c	f4d829739f2d6ba7e3ede83dad428a0ced1a703ec582fc73a4eee3df3704629a
libtcc.dll	4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906
admin	831e1ea13a1bd405f5bda2b9d8f2265f7b1db6c668dd2165ccc8a9c4c15ea7dd
loader1	0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd
uffhxpSy	4c2ea8193f4a5db63b897a2d3ce127cc5d89687f380b97a1d91e0c8db542e4f8
loader2	e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda
3yzr31vk	078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5
ConsoleApplication2.exe	b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3
system	7add554a98d3a99b319f2127688356c1283ed073a084805f14e33b4f6a6126fd
s047t5g.exe	fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a

Auxiliary malicious IOC files found by Secure List/Kapersky

Hashes of malicious auxiliary files 06a6a5a39193075734a32e0235bde0e979c27228 — load 9c3ba38890ed984a25abb6a094b5dbf052f22fa7 — load ca4b6fe0c69472cd3d63b212eb805b7f65710d33 — alien.ini 0d0f315fd8cf408a483f8e2dd1e69422629ed9fd — alien.ini 2a476cfb85fbf012fdbe63a37642c11afa5cf020 — alien.ini

Notepad++ Times are hard