528
Notepad++ Hijacked by State-Sponsored Hackers (notepad-plus-plus.org)
submitted 6 months ago by to c/technology@lemmy.world
91 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 6 months ago (1 child)

Looks like 8.8.1 was May 2025 https://notepad-plus-plus.org/news/v881-we-are-with-ukraine/

8.8.2 was June 2025 and has a warning to ignore "false positives" of malware in the update.... Ouch. https://notepad-plus-plus.org/news/8.8.2-available-in-1-week-without-certificate/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 6 months ago (1 child)

    You might have version 8.8.1 or lower, however it might have tried to order update got the vulnerable package instead and then remained on the older version. I think even if you have the older version that's not a sign that you weren't compromised.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (2 children)

    Fair point. I was assuming the malicious payload would come along with an update on order to hide, but it's also possible that the malicious payload was delivered without any update to notepad++.

    I've not seen any IOCs published have you?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    I'm not sure what you mean. The article states there were remote hands on keyboard noticed in multiple companies. That's how the vulnerability was discovered.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •