Notepad++ update hijack (CVE-2025-15556): Lotus Blossom served Chrysalis backdoor through WinGUp, June to December 2025

What happened

Notepad++ disclosed on 2 February 2026 that its update traffic had been hijacked by a state-sponsored group (Notepad++). The flaw was not in Notepad++ code. The attackers broke into the shared hosting provider that served notepad-plus-plus.org.

• June 2025: the incident began (Notepad++).
• Until 2 September 2025: the provider says the shared hosting server itself was compromised. A kernel and firmware update that day appears to have ended server access.
• Until 2 December 2025: the attackers still held credentials for the provider’s internal services, which let them keep redirecting update traffic. Notepad++ estimates the whole compromise ran from June to 2 December 2025.
• Target: the update script getDownloadUrl.php. The provider says the attackers searched for the notepad-plus-plus.org domain specifically. Traffic from “certain targeted users” was sent to attacker-controlled update manifests.

The root cause on the client side is CVE-2025-15556. In Notepad++ before 8.8.9, WinGUp did not cryptographically verify update metadata or installers, so anyone who could redirect update traffic could run their own installer with the user’s privileges. NVD scores it 7.5 (CWE-494) (NVD). CISA added it to the Known Exploited Vulnerabilities catalogue on 12 February 2026 (CISA KEV).

Attribution. Rapid7 linked the campaign to the China-linked Lotus Blossom group “with moderate confidence” and named the backdoor Chrysalis (The Register). Unit 42 also attributes it to Lotus Blossom. It saw targets mainly in Southeast Asia, in government, telecommunications and critical infrastructure, plus cloud hosting, energy, finance, manufacturing and software development in South America, the US and Europe (Unit 42).

How the payload works

Details from Unit 42 unless stated:

1. A targeted user’s updater received a malicious manifest and downloaded an NSIS installer, often named update.exe, run through the legitimate gup.exe (The Register).
2. Chain 1: the installer dropped a renamed Bitdefender Submission Wizard as BluetoothService.exe, which sideloaded a malicious log.dll. The DLL decrypted and ran the Chrysalis backdoor.
3. Chain 2: the installer ran a malicious Lua script that loaded a Cobalt Strike Beacon. In September and October 2025 this variant injected shellcode through the EnumWindowStationsW API.

Am I affected?

First, check the version on each Windows host. Anything below 8.8.9 was exposed if it updated itself during the window.

# Installed Notepad++ version
(Get-Item "$env:ProgramFiles\Notepad++\notepad++.exe").VersionInfo.ProductVersion
(Get-Item "${env:ProgramFiles(x86)}\Notepad++\notepad++.exe" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion

# The sideloading pair from chain 1, outside a real Bitdefender install
Get-ChildItem -Path C:\Users,C:\ProgramData -Recurse -Force -ErrorAction SilentlyContinue `
  -Include BluetoothService.exe,log.dll | Where-Object { $_.FullName -notmatch 'Bitdefender' }

# Hash any candidate files and compare with the list below
Get-FileHash -Algorithm SHA256 <path-to-file>

Indicators published by Unit 42:

• SHA-256: 1f6d28370f4c2b13f3967b38f67f77eee7f5fba9e7743b6c66a8feb18ae8f33e, a3cf1c86731703043b3614e085b9c8c224d4125370f420ad031ad63c14d6c3ec, a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9
• Domains: skycloudcenter[.]com, self-dns[.]it[.]com, safe-dns[.]it[.]com, cdncheck[.]it[.]com
• IPs: 95.179.213[.]0, 45.76.155[.]202, 45.77.31[.]210, 61.4.102[.]97, 59.110.7[.]32, 45.32.144[.]255
• URLs: 95.179.213[.]0/update/AutoUpdater.exe, 95.179.213[.]0/update/Upgrade.exe, 45.32.144[.]255/update/update.exe, 45.76.155[.]202/update/update.exe, 59.110.7[.]32/dpixel
• Mutex: Global\Jdhfv_1.0.1
• Behaviour: gup.exe writing files to \AppData\Local\Temp\ or \Windows\Temp, or spawning unusual child processes

Search DNS, proxy and EDR telemetry for these back to June 2025. Unit 42 notes that many teams will need cold storage to reach that far. Notepad++ itself published no indicators; it points to the Rapid7 and Kaspersky reports for more (Notepad++).

What to do now

1. Install 8.9.2 or later by hand from notepad-plus-plus.org rather than through the old updater. 8.8.9 added installer signature checks; 8.9.2 added and enforced a signed update manifest (XMLDSig), the “double lock” (Notepad++). 8.9.2 also removed libcurl.dll to close a DLL sideloading path.
2. Hunt before you upgrade. Upgrading does not remove Chrysalis or a Cobalt Strike Beacon. Run the checks above on any host that auto-updated between June and December 2025, starting with users in the sectors and regions Unit 42 lists.
3. Rebuild confirmed hosts. Treat a hit on a hash, the mutex or the BluetoothService.exe plus log.dll pair as a hands-on compromise by a state actor, not a commodity infection.
4. Block the network indicators at DNS and proxy level (Unit 42).
5. For managed fleets, turn off the built-in updater and push Notepad++ through your own software distribution. The MSI supports NOUPDATER=1, for example msiexec /i npp.8.9.2.Installer.x64.msi NOUPDATER=1 (Notepad++).

Why this matters

Signing the installer alone was not enough. The attackers controlled the manifest, which tells the updater where to download from. Notepad++ fixed this by signing both the manifest and the binary and verifying both on the client. If you ship software with an updater, check that it does the same.

Sources

• Notepad++: Hijacked by state-sponsored hackers (incident update, 2 February 2026)
• Notepad++: v8.9.2 released, “double lock” updater
• Unit 42: Notepad++ infrastructure compromise
• The Register: Notepad++ hijacking blamed on Lotus Blossom
• The Hacker News: Notepad++ fixes hijacked update mechanism
• NVD: CVE-2025-15556
• CISA Known Exploited Vulnerabilities catalogue (CVE-2025-15556)