Notepad++ Update Infrastructure Hacked by Chinese APT Group Lotus Blossom

Summary:

Notepad++, a popular free and open-source source code editor, was targeted in a sophisticated supply chain attack by a Chinese Advanced Persistent Threat (APT) group named Lotus Blossom. The hackers exploited the software's update infrastructure, not its source code, to deploy malware.

Key points:

Notepad++ is widely used by developers and system administrators due to its features and efficiency compared to default Notepad, bloated editors like VS Code, and complex ones like Vim.
The attack leveraged the "auto-update" feature, redirecting targeted users' update requests to a hacker-controlled server.
The malicious update.exe installer dropped a harmful DLL (log.dll) and an encrypted shellcode (BluetoothService).
log.dll performed DLL sideloading, decrypting and executing the shellcode to establish a persistent backdoor on the victim's machine.
Targeted organizations were primarily in East Asia, suggesting state-sponsored espionage by the Chinese government, potentially due to Notepad++'s history of expressing support for Taiwan, Hong Kong, Uyghurs, and Ukraine, and referencing the Tiananmen Square massacre.
Users are advised to update to the latest patched version and scan systems for Indicators of Compromise (IoCs).
Caution is recommended regarding automatic updates; verify the trustworthiness of the distribution mechanism.

Notepad++ Targeted by Chinese APT Group Lotus Blossom [0:00]

Notepad++ is a widely recommended free and open-source source code editor for beginners and casual programmers. [0:20]
It was the target of a supply chain attack by a Chinese Advanced Persistent Threat (APT) group known as Lotus Blossom. [0:30]

Why Notepad++ is a Popular Text Editor [0:34]

Notepad++ is seen as an improvement over the basic Notepad that ships with Windows, offering features like:
- Syntax highlighting for various programming languages. [1:12]
- Automatic indentation. [1:17]
- Auto-complete. [1:19]
- Tabbed interface for multiple documents, a feature Microsoft's Notepad only recently acquired. [1:21]
Advantages over other text editors:
- It is free and open-source, unlike Sublime Text. [1:31]
- It is not a bloated Electron app like VS Code, consuming significantly less RAM. [1:34]
- It's user-friendly, not requiring a month to learn like Vim, and "just works" out of the box. [1:44]

The Appeal of Notepad++ for Attackers [2:05]

Ubiquitous "just works" programs like Notepad++, especially those with auto-update infrastructure, are excellent targets for supply chain attacks. [1:57]
The software is frequently used by system administrators and developers who often possess privileged access to an organization's files and systems. [2:08]
Compromising these individuals can lead to a takeover of most of the enterprise. [2:18]

The Supply Chain Attack Mechanism [2:20]

The attackers compromised the update infrastructure of Notepad++, not the application's source code itself. [2:35]
Notepad++ includes an auto-update feature (GUP.exe), which, if enabled on an outdated version, was exploited to deliver malicious payloads. [2:55]
This method is sneakier than direct application compromise, as open-source code, while inspectable, is rarely audited by the vast majority of users. [3:11]
The XZ Utils backdoor incident is cited as another example where a bug was discovered by an "elite" user in an open-source library. [3:40]

Chrysalis Backdoor Deployment [3:45]

The malicious update payload, named Chrysalis by security researchers, was selectively triggered on specific targets. [3:50]
The compromised GUP.exe connected to a hacker-controlled server instead of the legitimate Notepad++ update server. [4:06]
The update.exe program, an NSIS installer, performed the following steps: [4:21]
- Dropped log.dll, identified as a malicious DLL. [4:32]
- Dropped an encrypted shellcode file named BluetoothService in a hidden directory. [4:50]
- Executed BluetoothService.exe (a renamed legitimate Bitdefender Submission Wizard). [5:09]
- BluetoothService.exe then performed DLL sideloading, loading log.dll instead of the legitimate library. [5:14]
- log.dll decrypted and executed the final malicious payload in memory, creating a persistent backdoor on the victim's machine. [5:22]

Targets and Potential Motivations [5:30]

Targeted organizations were primarily located in East Asia. [5:35]
This indicates that the Chinese government likely sponsored the hacking group to spy on these organizations and potentially steal trade secrets. [5:40]
Notepad++'s history of taking political stances in its release notes may have made it a target for the Chinese government: [6:00]
- Multiple instances of support for Ukraine. [6:13]
- Support for Taiwan's sovereignty and its return to the UN. [6:27]
- Past support for Hong Kong and the Uyghur people. [6:39]
- A reference to the Tiananmen Square Massacre. [6:49]

Recommendations for Users [7:25]

Update Notepad++ to the latest patched version immediately, as security fixes for this issue have been released. [7:29]
Scan systems for Indicators of Compromise (IoCs) related to this incident. A link to Rapid7's detailed report is provided in the video description. [7:34]
Exercise caution with automatic software updates, and try to verify the source of updates. [7:45]
Organizations that publicly challenge totalitarian governments should implement robust security measures to protect their infrastructure. [7:57]