528
Notepad++ Hijacked by State-Sponsored Hackers (notepad-plus-plus.org)
submitted 6 months ago by to c/technology@lemmy.world
91 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 6 months ago (2 children)

The timeline says the attack started in June of 2025 and continued through Dec 2, 2025. If you installed, updated, or silently updated during that period you may have been targeted / compromised.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 6 months ago (1 child)

    What was the latest version before June 2025?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 12 points 6 months ago (1 child)

    Looks like 8.8.1 was May 2025 https://notepad-plus-plus.org/news/v881-we-are-with-ukraine/

    8.8.2 was June 2025 and has a warning to ignore "false positives" of malware in the update.... Ouch. https://notepad-plus-plus.org/news/8.8.2-available-in-1-week-without-certificate/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 6 months ago (1 child)

    You might have version 8.8.1 or lower, however it might have tried to order update got the vulnerable package instead and then remained on the older version. I think even if you have the older version that's not a sign that you weren't compromised.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (2 children)

    Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++.

    I've not seen any IOCs published have you?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    How would you know if you updated?

    My notepad++ is on 8.9.1 and I have no idea how it's on that ver (ninite I think is where I sourced it....maybe it's auto updating?)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (2 children)

    Odds are you weren't on the "targeted list".

    If you don't know, you're probably auto updating.

    If you updated or installed in 2025 after June-ish, the safe thing to do is uninstall, then download from the new (theoretically more secure) website and install the new (theoretically more secure) 8.9.1.

    If you were pwned by an update during later 2025, they could disguise just about anything in your Notepad++ and its associated files - make it look perfectly normal, make it act perfectly normal, but have their own malware on your system doing... whatever it is they want it to do.

    I understand one of the things they were doing is running a proxy to carry traffic through your system, so if you see a lot of unexpected network activity (under Windoze how can you tell?) you may have been compromised. But that's not the only thing they could have done, nobody has really analyzed the attack yet and even after they do, you might have gotten a "special" payload that the analysis team didn't see...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 6 months ago

    Unfortunately i do work for a targeted company (we do a lot of secret squirrel stuff) in south East Asia.

    We get a lot of attacks.

    I was looking at the attack and malware they inject (there is a blog post link on the notepad++ notice) which pointed out how the attack worked. Apparently they run a service called bluetoothservice.exe. I didn't see anything like that or any the other stuff they said gets created.

    But then again finding malware isn't my bag so who knows.

    Pretty sure my updates came via nanite installer so I'm hoping I wasn't targeted.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 6 months ago (1 child)

    the safe thing to do is uninstall, then download from the new (theoretically more secure) website and install the new (theoretically more secure) 8.9.1.

    That won't rescue your system if it is already compromised though. It will just prevent it from being newly compromised in this manner.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 6 months ago*

    True, but in this case it seems worth doing due to the relatively patient, selective nature of the attack - it would at least clean out a compromised Notepad++ if it had not spread to a wider system compromise yet.

  • permalink
  • fedilink
  • source
  • parent