▲ 516 ▼ Notepad++ Hijacked by State-Sponsored Hackers (notepad-plus-plus.org) submitted 9 months ago by Beep@lemmus.org to c/technology@lemmy.world 53 comments fedilink hide all child comments
[+] MangoCats@feddit.it 11 points 9 months ago (9 children) [removed by mod] permalink fedilink source parent hideshow 9 child comments replies: [–] Snazz@lemmy.world 2 points 9 months ago (7 children) What was the latest version before June 2025? permalink fedilink source parent hideshow 7 child comments replies: [–] pez@piefed.blahaj.zone 12 points 9 months ago (6 children) Looks like 8.8.1 was May 2025 https://notepad-plus-plus.org/news/v881-we-are-with-ukraine/ 8.8.2 was June 2025 and has a warning to ignore "false positives" of malware in the update.... Ouch. https://notepad-plus-plus.org/news/8.8.2-available-in-1-week-without-certificate/ permalink fedilink source parent hideshow 6 child comments replies: [–] AceBonobo@lemmy.world 3 points 9 months ago (5 children) You might have version 8.8.1 or lower, however it might have tried to order update got the vulnerable package instead and then remained on the older version. I think even if you have the older version that's not a sign that you weren't compromised. permalink fedilink source parent hideshow 5 child comments replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago (4 children) Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++. I've not seen any IOCs published have you? permalink fedilink source parent hideshow 4 child comments replies: [–] floofloof@lemmy.ca 1 point 9 months ago* (1 child) There's some IOC information here: https://securelist.com/notepad-supply-chain-attack/118708/ And here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 2 points 9 months ago Thanks! permalink fedilink source parent [–] AceBonobo@lemmy.world 1 point 9 months ago (1 child) I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered. permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent [–] how_we_burned@lemmy.zip 1 point 9 months ago How would you know if you updated? My notepad++ is on 8.9.1 and I have no idea how it's on that ver (ninite I think is where I sourced it....maybe it's auto updating?) permalink fedilink source parent replies: [+] MangoCats@feddit.it 1 point 9 months ago (1 child) [removed by mod] permalink fedilink source parent hideshow 1 child comment replies: [–] floofloof@lemmy.ca 2 points 9 months ago (-1 children) the safe thing to do is uninstall, then download from the new (theoretically more secure) website and install the new (theoretically more secure) 8.9.1. That won't rescue your system if it is already compromised though. It will just prevent it from being newly compromised in this manner. permalink fedilink source parent hideshow -1 child comments load more comments (-1 replies) [–] how_we_burned@lemmy.zip 2 points 9 months ago Unfortunately i do work for a targeted company (we do a lot of secret squirrel stuff) in south East Asia. We get a lot of attacks. I was looking at the attack and malware they inject (there is a blog post link on the notepad++ notice) which pointed out how the attack worked. Apparently they run a service called bluetoothservice.exe. I didn't see anything like that or any the other stuff they said gets created. But then again finding malware isn't my bag so who knows. Pretty sure my updates came via nanite installer so I'm hoping I wasn't targeted. permalink fedilink source parent load more comments (-2 replies)
[–] Snazz@lemmy.world 2 points 9 months ago (7 children) What was the latest version before June 2025? permalink fedilink source parent hideshow 7 child comments replies: [–] pez@piefed.blahaj.zone 12 points 9 months ago (6 children) Looks like 8.8.1 was May 2025 https://notepad-plus-plus.org/news/v881-we-are-with-ukraine/ 8.8.2 was June 2025 and has a warning to ignore "false positives" of malware in the update.... Ouch. https://notepad-plus-plus.org/news/8.8.2-available-in-1-week-without-certificate/ permalink fedilink source parent hideshow 6 child comments replies: [–] AceBonobo@lemmy.world 3 points 9 months ago (5 children) You might have version 8.8.1 or lower, however it might have tried to order update got the vulnerable package instead and then remained on the older version. I think even if you have the older version that's not a sign that you weren't compromised. permalink fedilink source parent hideshow 5 child comments replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago (4 children) Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++. I've not seen any IOCs published have you? permalink fedilink source parent hideshow 4 child comments replies: [–] floofloof@lemmy.ca 1 point 9 months ago* (1 child) There's some IOC information here: https://securelist.com/notepad-supply-chain-attack/118708/ And here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 2 points 9 months ago Thanks! permalink fedilink source parent [–] AceBonobo@lemmy.world 1 point 9 months ago (1 child) I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered. permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent
[–] pez@piefed.blahaj.zone 12 points 9 months ago (6 children) Looks like 8.8.1 was May 2025 https://notepad-plus-plus.org/news/v881-we-are-with-ukraine/ 8.8.2 was June 2025 and has a warning to ignore "false positives" of malware in the update.... Ouch. https://notepad-plus-plus.org/news/8.8.2-available-in-1-week-without-certificate/ permalink fedilink source parent hideshow 6 child comments replies: [–] AceBonobo@lemmy.world 3 points 9 months ago (5 children) You might have version 8.8.1 or lower, however it might have tried to order update got the vulnerable package instead and then remained on the older version. I think even if you have the older version that's not a sign that you weren't compromised. permalink fedilink source parent hideshow 5 child comments replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago (4 children) Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++. I've not seen any IOCs published have you? permalink fedilink source parent hideshow 4 child comments replies: [–] floofloof@lemmy.ca 1 point 9 months ago* (1 child) There's some IOC information here: https://securelist.com/notepad-supply-chain-attack/118708/ And here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 2 points 9 months ago Thanks! permalink fedilink source parent [–] AceBonobo@lemmy.world 1 point 9 months ago (1 child) I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered. permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent
[–] AceBonobo@lemmy.world 3 points 9 months ago (5 children) You might have version 8.8.1 or lower, however it might have tried to order update got the vulnerable package instead and then remained on the older version. I think even if you have the older version that's not a sign that you weren't compromised. permalink fedilink source parent hideshow 5 child comments replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago (4 children) Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++. I've not seen any IOCs published have you? permalink fedilink source parent hideshow 4 child comments replies: [–] floofloof@lemmy.ca 1 point 9 months ago* (1 child) There's some IOC information here: https://securelist.com/notepad-supply-chain-attack/118708/ And here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 2 points 9 months ago Thanks! permalink fedilink source parent [–] AceBonobo@lemmy.world 1 point 9 months ago (1 child) I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered. permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent
[–] pez@piefed.blahaj.zone 1 point 9 months ago (4 children) Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++. I've not seen any IOCs published have you? permalink fedilink source parent hideshow 4 child comments replies: [–] floofloof@lemmy.ca 1 point 9 months ago* (1 child) There's some IOC information here: https://securelist.com/notepad-supply-chain-attack/118708/ And here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 2 points 9 months ago Thanks! permalink fedilink source parent [–] AceBonobo@lemmy.world 1 point 9 months ago (1 child) I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered. permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent
[–] floofloof@lemmy.ca 1 point 9 months ago* (1 child) There's some IOC information here: https://securelist.com/notepad-supply-chain-attack/118708/ And here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 2 points 9 months ago Thanks! permalink fedilink source parent
[–] AceBonobo@lemmy.world 1 point 9 months ago (1 child) I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered. permalink fedilink source parent hideshow 1 child comment replies: [–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent
[–] pez@piefed.blahaj.zone 1 point 9 months ago* (last edited 9 months ago) I mean IOCs that you can scan for in an environment to see if a machine has been compromised using this vulnerability. Something that tells you if you need to do additional remediation on a machine or just update notepad++ and move on. Edit: Found some! This is the type of info I was thinking of when I used IOCs https://securelist.com/notepad-supply-chain-attack/118708/ permalink fedilink source parent
[–] how_we_burned@lemmy.zip 1 point 9 months ago How would you know if you updated? My notepad++ is on 8.9.1 and I have no idea how it's on that ver (ninite I think is where I sourced it....maybe it's auto updating?) permalink fedilink source parent replies: [+] MangoCats@feddit.it 1 point 9 months ago (1 child) [removed by mod] permalink fedilink source parent hideshow 1 child comment replies: [–] floofloof@lemmy.ca 2 points 9 months ago (-1 children) the safe thing to do is uninstall, then download from the new (theoretically more secure) website and install the new (theoretically more secure) 8.9.1. That won't rescue your system if it is already compromised though. It will just prevent it from being newly compromised in this manner. permalink fedilink source parent hideshow -1 child comments load more comments (-1 replies) [–] how_we_burned@lemmy.zip 2 points 9 months ago Unfortunately i do work for a targeted company (we do a lot of secret squirrel stuff) in south East Asia. We get a lot of attacks. I was looking at the attack and malware they inject (there is a blog post link on the notepad++ notice) which pointed out how the attack worked. Apparently they run a service called bluetoothservice.exe. I didn't see anything like that or any the other stuff they said gets created. But then again finding malware isn't my bag so who knows. Pretty sure my updates came via nanite installer so I'm hoping I wasn't targeted. permalink fedilink source parent load more comments (-2 replies)
[+] MangoCats@feddit.it 1 point 9 months ago (1 child) [removed by mod] permalink fedilink source parent hideshow 1 child comment replies: [–] floofloof@lemmy.ca 2 points 9 months ago (-1 children) the safe thing to do is uninstall, then download from the new (theoretically more secure) website and install the new (theoretically more secure) 8.9.1. That won't rescue your system if it is already compromised though. It will just prevent it from being newly compromised in this manner. permalink fedilink source parent hideshow -1 child comments load more comments (-1 replies) [–] how_we_burned@lemmy.zip 2 points 9 months ago Unfortunately i do work for a targeted company (we do a lot of secret squirrel stuff) in south East Asia. We get a lot of attacks. I was looking at the attack and malware they inject (there is a blog post link on the notepad++ notice) which pointed out how the attack worked. Apparently they run a service called bluetoothservice.exe. I didn't see anything like that or any the other stuff they said gets created. But then again finding malware isn't my bag so who knows. Pretty sure my updates came via nanite installer so I'm hoping I wasn't targeted. permalink fedilink source parent
[–] floofloof@lemmy.ca 2 points 9 months ago (-1 children) the safe thing to do is uninstall, then download from the new (theoretically more secure) website and install the new (theoretically more secure) 8.9.1. That won't rescue your system if it is already compromised though. It will just prevent it from being newly compromised in this manner. permalink fedilink source parent hideshow -1 child comments load more comments (-1 replies)
[–] how_we_burned@lemmy.zip 2 points 9 months ago Unfortunately i do work for a targeted company (we do a lot of secret squirrel stuff) in south East Asia. We get a lot of attacks. I was looking at the attack and malware they inject (there is a blog post link on the notepad++ notice) which pointed out how the attack worked. Apparently they run a service called bluetoothservice.exe. I didn't see anything like that or any the other stuff they said gets created. But then again finding malware isn't my bag so who knows. Pretty sure my updates came via nanite installer so I'm hoping I wasn't targeted. permalink fedilink source parent