Résumé
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
Comment le corriger
- Treat a compromised distribution host as fully attacker-controlled: migrate off it rather than cleaning in place, and rebuild the release path from trusted media.
- Rotate every credential the host touched (SSH, SFTP, database); here the attackers persisted for months on stolen credentials even after losing direct access.
- Hunt with the published indicators (C2 domains and IPs, the side-loaded log.dll and renamed Bluetooth service binary, the single-instance mutex), since selective targeting means no mass alert will fire.
- Tell users to update to Notepad++ 8.9.1 or later and to treat any update pulled between June and December 2025 as suspect on high-value machines.
Comment l’éviter dans votre code
- Sign and verify the update manifest, not just the binary, and fail closed when verification fails; never fall back to installing anyway.
- Enforce code-signature and certificate checks on the client for every downloaded artifact (the core lesson of CWE-494).
- Remember that TLS proves transport, not integrity: an infrastructure-level redirect defeats it, so end-to-end signing of the payload is the real control.
- Treat the update channel as a tier-0 asset: isolate and monitor the distribution servers, and minimize the credential blast radius around them.
- Add defense in depth against DLL side-loading (application allow-listing, load-path monitoring), since the payloads hid inside legitimately signed binaries.
Détails de l’avis
How it happened
WinGUp, the auto-updater bundled with Notepad++, fetches an XML manifest that tells it where to download the installer, then downloads and runs that installer with the user's privileges. Older WinGUp builds verified neither the manifest nor the binary, so nothing stopped a tampered manifest from pointing the updater at a malicious payload. That missing integrity check is CVE-2025-15556, a textbook case of executing downloaded code without verifying it. Rather than swap the file for everyone, the attackers compromised the shared-hosting provider behind the update domain and intercepted update requests at the infrastructure layer, redirecting only specific targeted machines to their own servers while serving the real update to all other users. That selectivity is exactly why the supply-chain attack went unnoticed for about six months. It is the same surgical shape as ASUS ShadowHammer: poison the channel that millions trust, but activate for only a precise few.
The payload
Researchers documented three rotating execution chains across the campaign, each arriving through a poisoned update. Early chains side-loaded shellcode through legitimate signed binaries (an old ProShow component, then a Lua interpreter) to stage a Cobalt Strike beacon. The final chain, in October 2025, used DLL side-loading through a renamed but legitimately signed Bitdefender utility to load a previously unseen backdoor the researchers named Chrysalis. Chrysalis exposes roughly sixteen commands (an interactive reverse shell, process and file operations, drive enumeration, chunked exfiltration, self-cleanup), resolves its API calls dynamically, and talks to its command-and-control over RC4-encrypted HTTPS while spoofing a Chrome user agent (primary C2 at api.skycloudcenter.com, resolving to a host in Malaysia). One loader even abused Microsoft's undocumented "Warbird" facility to run shellcode inside the memory of a Microsoft-signed process, a deliberate anti-detection move.
Who was behind it
Rapid7, which led the investigation, attributed the campaign with moderate confidence to Lotus Blossom (also tracked as Billbug, Thrip, and Spring Dragon), a Chinese state-sponsored APT active since around 2009. The assessment rests on tradecraft and infrastructure overlap rather than a smoking gun: the renamed-Bitdefender side-loading technique, shared Cobalt Strike keys, and overlapping C2 domains all match prior Lotus Blossom operations. Kaspersky and Broadcom/Symantec independently corroborated the campaign, with Symantec attributing it to Billbug. The victims fit classic espionage targeting: fewer than two dozen machines in total, including a government body in the Philippines, a financial organization in El Salvador, and an IT-services provider in Vietnam, with other individual targets in Vietnam, El Salvador, and Australia.
Why it still matters
This is the modern update-supply-chain attack in miniature, and a close cousin of SolarWinds, CCleaner, and the eScan antivirus compromise that followed weeks later. The source code was never altered, so no code review or SBOM would have caught it; the failure was that the client trusted its delivery channel and ran whatever it downloaded. Notepad++ rotated all hosting credentials, migrated to a new provider, and hardened WinGUp: version 8.8.9 began verifying the installer's certificate and signature, 8.9.1 is the recommended minimum, and 8.9.2 also verifies the signed XML manifest end to end. CVE-2025-15556 was later added to the US CISA Known Exploited Vulnerabilities catalog. The lesson is blunt: a trusted update endpoint is a tier-0 asset, and transport security (TLS) is not the same thing as verifying the integrity of the code you are about to execute.
Références
- https://www.rapid7.com/blog/post/tr-chrysalis-notepad-supply-chain-risk-next-steps/
- https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
- https://notepad-plus-plus.org/news/hijacked-incident-info-update/
- https://securelist.com/tr/notepad-supply-chain-attack/120106/
- https://www.bleepingcomputer.com/news/security/notepad-plus-plus-update-feature-hijacked-by-chinese-state-hackers-for-months/
- https://nvd.nist.gov/vuln/detail/CVE-2025-15556
Vulnérabilités liées
Tout Supply chain →- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALCVE-2019-15107
Disclosed in August 2019, CVE-2019-15107 was an unauthenticated remote code execution backdoor in Webmin, a widely deployed web-based system administration tool that runs with root privileges. The backdoor existed in the password_change.cgi feature: a Perl qx() statement passed the unsanitized old (and in some versions expired) parameter from the password-change request straight to a shell, letting an unauthenticated attacker run arbitrary commands as root, with version 1.890 exploitable in its default configuration and 1.900 through 1.920 exploitable when password expiry was enabled. Critically, the malicious code was never present in Webmin's GitHub source, which remained clean; it was inserted directly into the build infrastructure that produced the official SourceForge release packages, so users who installed signed official builds were backdoored while anyone auditing the public Git source saw nothing wrong. Webmin later confirmed the code was added on its build server on two separate occasions, in April 2018 producing the 1.890 release and again in July 2018 reintroducing it into 1.900 through 1.920, meaning backdoored builds were distributed for over a year. The project released 1.930 on August 17, 2019 to remove the backdoor.
- HIGHSC-CCLEANER-2017
In September 2017, Cisco Talos revealed that CCleaner, a hugely popular Windows cleanup tool from Piriform (newly acquired by Avast), had been shipping a backdoor. Attackers had compromised Piriform's build environment and inserted malicious code into the official, validly code-signed installer, so version 5.33 distributed through Piriform's own channels carried the malware to about 2.27 million users for roughly a month before anyone noticed. The first stage merely profiled machines, but it was a sniper rather than a shotgun: from the millions of installs it served a second stage to only a few dozen selected computers at companies like Google, Microsoft, Cisco, Intel, and Samsung, and a still deeper espionage tool (the ShadowPad backdoor) was later found planted on Piriform's own internal machines. The attack is linked to the China-nexus group tracked as APT17 / Axiom. It is the lesson that a trusted update channel and a valid signature are not the same as trustworthy code, and that build pipelines are prime targets.
- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- HIGHGHSA-xhcr-cqfr-m3hv
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.