One PHP Endpoint, Six Months of Access: Inside the Notepad++ Supply Chain Compromise
The Vulnerability That Made It Possible
For years, Notepad++'s update mechanism operated on a dangerous assumption: trust whatever URL the server returns.
When users clicked "Check for updates," the WinGUP updater queried notepad-plus-plus.org/getDownloadUrl.php and downloaded whatever executable that endpoint specified. No certificate pinning. No hash verification. No signature check. The updater simply executed what it received.
This meant anyone who controlled that single PHP endpoint controlled what millions of Notepad++ users would install next.
In June 2025, Chinese state-sponsored group Lotus Blossom gained exactly that control.
How They Got In
Notepad++ runs on shared hosting infrastructure. The attackers didn't need to breach Notepad++ directly - they compromised the hosting provider, gained access to the server, and modified how getDownloadUrl.php responded to requests.
But here's what made this campaign sophisticated: they didn't poison every update request. The attackers implemented selective targeting, redirecting only specific organizations to attacker-controlled infrastructure while legitimate users received normal updates. This kept the compromise invisible for six months.
The hosting provider later confirmed that attackers "specifically searched for the Notepad++ domain to intercept traffic" - this wasn't collateral damage from a broader hosting breach. It was a targeted operation.
Four Months, Three Attack Chains
What makes this campaign particularly interesting is how the attackers evolved their tradecraft over time - adapting to operational setbacks and progressively deploying more sophisticated tooling.
July-August: The Commodity Approach
The initial attack chain was straightforward: an NSIS installer dropped ProShow.exe (a legitimate Photodex binary) alongside a malicious DLL. When ProShow executed, it sideloaded the DLL, which decrypted embedded Metasploit shellcode that fetched a Cobalt Strike beacon.
Standard red team tooling. Nothing custom. This suggests the operators were either testing their access or working under time pressure.
Reconnaissance data (whoami, tasklist output) was exfiltrated to temp[.]sh - a legitimate file-sharing service that blends into normal traffic.
September 2: The Setback
On September 2nd, the hosting provider performed routine maintenance - kernel and firmware updates. This inadvertently terminated the attackers' direct server access.
But they weren't locked out completely. The attackers retained credentials for internal services, including the ability to redirect traffic from getDownloadUrl.php. The operation continued.
Mid-September: Going Lighter
Post-setback, the attackers deployed a significantly smaller payload - 140KB versus the previous multi-megabyte installers. The new chain used Lua scripts to execute shellcode, writing to %APPDATA%\Adobe\Scripts - a path that looks legitimate at a glance.
They also expanded reconnaissance, adding netstat collection to map network connections on compromised hosts.
October: The Custom Tooling Arrives
By October, Lotus Blossom deployed their flagship implant: Chrysalis.
The delivery mechanism shifted to abusing BluetoothService.exe - a renamed Bitdefender Submission Wizard binary. This legitimate, signed executable would load log.dll (malicious) which decrypted shellcode from a separate file.
The sophistication jump was significant. The shellcode leveraged Microsoft Warbird - an obfuscation framework Microsoft uses to protect DRM code. Lotus Blossom adapted a proof-of-concept published by security researchers in September 2024, weaponizing it for their own shellcode execution.
Chrysalis: Purpose-Built for Persistence
Chrysalis isn't off-the-shelf malware. Analysis indicates active development - the codebase shows iteration and refinement rather than static deployment.
What makes it notable:
- Undocumented syscalls: Chrysalis uses
NtQuerySystemInformationwith parameters not covered in public documentation - a technique that evades security tools monitoring standard API calls - Infrastructure rotation: C2 servers, downloaders, and payloads rotated monthly - never giving defenders a static target
- Full-featured backdoor: Interactive shell, file operations, upload/download, process manipulation, self-destruct capability
C2 communications occurred over api.skycloudcenter[.]com - a domain designed to look like legitimate cloud infrastructure.
The Target Profile
Only ~12 machines were compromised over six months. This wasn't a mass campaign - it was precision targeting.
The geographic spread maps directly to Chinese foreign policy priorities. Lotus Blossom, active since at least 2009, has historically focused on government and diplomatic targets in Southeast Asia - this campaign fits their established pattern.
Detection: What to Hunt For
Generic IOC blocking isn't enough - the attackers rotated infrastructure monthly. Focus on behavioral patterns:
DLL Sideloading Signatures
# Suspicious: Bitdefender binary outside normal install path Process: BluetoothService.exe NOT in: %ProgramFiles%\Bitdefender\* # Suspicious: ProShow.exe (discontinued software) executing Process: ProShow.exe Loading: Any DLL not signed by Photodex # Suspicious: Renamed security vendor binaries Any process where: - PE metadata indicates Bitdefender/Trend Micro origin - Filename doesn't match original
Network Indicators
# Known C2 domains (historical - likely rotated) api.skycloudcenter[.]com self-dns[.]it safe-dns[.]it cdncheck[.]it api.wiresguard[.]com # Distribution servers 45.76.155[.]202 95.179.213[.]0 # Exfiltration pattern POST requests to temp[.]sh containing system enumeration output
File System Artifacts
# Paths used by attack chains %APPDATA%\Bluetooth\* # Chain #3 working directory %APPDATA%\Adobe\Scripts\* # Chain #2 Lua execution # Suspicious files log.dll # Malicious loader (generic name, high suspicion) BluetoothService (no extension) # Encrypted shellcode blob
MITRE ATT&CK Coverage
The Fix and the Bigger Picture
Notepad++ v8.8.9, released December 2025, finally implements what should have existed from the start: certificate verification and signature validation for downloaded updates. The WinGUP updater now verifies that installers are legitimately signed before execution.
But this campaign highlights a systemic issue beyond one application. Software update mechanisms are high-value targets precisely because users trust them implicitly. When an application says "update available," most users click yes without hesitation.
Questions organizations should be asking:
- Which applications in our environment auto-update without signature verification?
- Do we have visibility into update traffic patterns that could detect hijacking?
- Are we monitoring for DLL sideloading via legitimate signed binaries?
The Notepad++ compromise wasn't technically sophisticated at its core - it exploited a trust assumption that should never have existed. The sophistication was in the patience (six months), the precision (12 targets), and the adaptation (three distinct attack chains evolving over time).
That combination - simple initial access, precise targeting, patient operation - is the hallmark of state-sponsored espionage.
