UAC-0099 Is Hiding MATCHBOIL.V2 Inside Fake Notepad++ Plugins — Audit Your Extensions Now

Ukraine's Computer Emergency Response Team has published an active-threat advisory: the state-linked cluster UAC-0099 is delivering MATCHBOIL.V2 — an updated Windows implant — by disguising it as a legitimate Notepad++ plugin. If your Windows endpoints have Notepad++ installed (and most do), this campaign is directly relevant to you.

What Happened

CERT-UA's warning identifies UAC-0099, a threat actor previously linked to Russian intelligence operations, as the source of this campaign. Attackers are distributing a file that presents as a normal Notepad++ extension. Once installed, MATCHBOIL.V2 executes and establishes persistence — no UAC prompt, no obvious red flag. The "V2" designation matters: it signals active tooling development, which means older MATCHBOIL signatures in your SIEM or EDR may be stale and won't catch this variant.

Why It Matters

Notepad++ is on practically every Windows workstation in a technical org. Users install plugins routinely and without suspicion — that normalized trust is precisely the attack surface UAC-0099 is exploiting.

Three properties make this delivery method dangerous:

• Bypasses email filtering. The payload doesn't need to arrive as an attachment. It can come via a poisoned search result, a fake community page, or a GitHub impersonation repo.
• No admin rights required. Per-user plugin installs drop into %APPDATA%\Notepad++\plugins\ silently. UAC never fires.
• EDR blind spots. A malicious DLL loaded by the trusted notepad++.exe process is far less likely to trip behavior-based detections than a standalone executable.

CERT-UA's primary mandate covers Ukrainian targets, but UAC-0099 campaigns have previously spread well beyond that scope. Treat this as a live, relevant threat regardless of your geography.

What To Do

1. Audit installed plugins right now. Open Notepad++ → Plugins → Plugin Admin → Installed tab. Any plugin not listed in the official nppPluginList repository should be considered suspect and removed.

2. Inspect the plugin directories on disk. Check both locations:

• System install: %PROGRAMFILES%\Notepad++\plugins\
• Per-user: %APPDATA%\Notepad++\plugins\

Hash any unfamiliar DLLs. Submit unknowns to VirusTotal or compare against the vendor's known-good builds.

3. Pull and deploy CERT-UA's IoCs immediately. The full advisory includes file hashes and behavioral indicators. Push them into your SIEM detection rules and EDR blocklists before end of day.

4. Hunt for MATCHBOIL.V1 artifacts too. If earlier MATCHBOIL detections were dismissed as false positives, revisit them. A V2 upgrade often follows a V1 foothold that was never fully remediated.

5. Lock down plugin loading in managed environments. If your org doesn't have a business need for user-installed Notepad++ plugins, restrict it now via GPO or application config hardening before the next incident forces your hand.

This is an active campaign with iterative tooling — not a theoretical risk. The action window is short.