The Hijacking of Notepad++

Cybersecurity is tricky. You can make all the right decisions to protect your network and data (using MFA, training employees to recognize when they’re being phished, keeping your software updated, etc.) but that still wouldn’t be enough. In reality, you don’t have control over everything that could cause a breach in your company. This is true because you use technology and software whose cybersecurity is maintained by third parties, and that technology can give hackers a gateway into your network. If, for example, you use Notepad++, then a certain Chinese state-sponsored cybergang could have injected a malicious backdoor into your systems.

Notepad++

If you’re not already familiar, Notepad++ is a beloved open source text editor that touts itself as a version of Microsoft’s Notepad software with enhanced functionality and more features. In the two decades since its release, this software has attracted millions of users who, thanks to Notepad++ being open-source, have continuously added new features to the editor.

But Notepad++’s popularity makes it an attractive target for hackers, which leads us to earlier this month when Notepad++’s creator Don Ho disclosed a security incident that occurred over a span of six months last year.

The Breach

In June 2025, the hosting provider used by Notepad++ was compromised by a Chinese state-sponsored hacking group, identified by researchers at Rapid7 as the APT group Lotus Blossom. With access to this hosting provider, Lotus Blossom was able to redirect update traffic from WinGUp (the Notepad++ auto-updater) to command-and-control (C2) servers under their control. From these C2 servers, the cybergang was able to send malicious updates to targets of their choosing.

Research from Kaspersky shows that over the course of the compromise, the infection chain used by Lotus Blossom changed several times until their access was finally purged and blocked on December 2nd. Georgy Kucherin from Kaspersky writes “from July to October 2025, attackers who had compromised Notepad++ had been constantly rotating C2 server addresses used for distributing malicious updates, the downloaders used for implant delivery, as well as the final payloads.” Lotus Blossom also remained highly selective of their targets, with the only confirmed victims being a small number of organizations with ties to East Asia. This selectiveness paired with their regular changing of infection chains made this attack difficult to detect.

Regardless of the infection chain, the final payload delivered served as a backdoor into the targets’ systems. Two backdoors were seen deployed:

Cobalt Strike Beacon, a commercially available adversary simulation software that is often stolen and misused by threat actors like Lotus Blossom
Chrysallis, a custom, feature-rich backdoor that was previously undocumented until it was discovered by Rapid7 researchers

While Notepad++’s hosting provider resolved the incident that caused the initial compromise by September 2nd, 2025, Lotus Blossom maintained credentials to internal services that allowed them to continue redirecting update traffic. Analysis of the incident shows that attacks finally ceased on November 10th, and the hosting provider completed the remediation and security hardening necessary to block further attacker access on December 2nd, ending the incident.

Below is a full timeline of the incident:

Notepad++ Hijacking Timeline

Ho reports that, as part of the mitigation for this incident, “Notepad++ & WinGUp have been hardened to verify the signature & certificate of downloaded installers during the update process. If verification fails, the update will be aborted.” Additionally, the website for Notepad++ was migrated to a different hosting provider with better security practices.

Ho advises all Notepad++ users to update to v8.9.1 to gain the necessary security enhancement, though he points out that if a user wasn’t a “strategic target” of Lotus Blossom, then they were likely never at risk.

Conclusion

This breach is a perfect example of how difficult cybersecurity can be. If you use Notepad++, then you were exposed to attacks from Lotus Blossom for 6 months through no security failure of your own. In fact, the security failure doesn’t even fall to Notepad++ since it was the software’s hosting provider, which wasn’t named, that ultimately had the fatal flaw. A vulnerability in a hosting software two degrees removed from your company could have allowed a backdoor to be installed on your network.

This isn’t to say that this interdependence is a bad thing, however. Part of this wonderful age of technology is that if we want to make something new, we don’t have to start from scratch, since it’s likely that people before us have already developed the building blocks we need. It’s just that one of the tradeoffs to relying on each other’s innovations is we sometimes fall victim to a security oversight somewhere up the line.

Part of good cybersecurity is having a plan in place for when a breach does happen, because sometimes it’s just out of your company’s control. If you’re not confident in your ability to perform damage control and mitigate the impact of a data breach, Crimson Vista offers services like SecurityHub that can help you form and implement such plans. In the meantime, stay vigilant and keep your software up-to-date, a cyberattack can come from anywhere.

The Hijacking of Notepad++

Notepad++

The Breach

Conclusion

Sources

Keep reading.

Psychology-Aware Security Design

AI: The New Face of Cybersecurity

The Limitations of Hashing for Data Anonymization