China's State-Backed Hackers Hacked Notepad++, Leaving Thousands Vulnerable to Attacks
In a shocking discovery, suspected China-state hackers have compromised the update infrastructure of popular free source code editor and note-taking app Notepad++. For six months, these hackers hijacked the update process, delivering a backdoored version of the app to select targets.
The attack began last June with an "infrastructure-level compromise" that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The hackers then selectively redirected certain targeted users to malicious update servers where they received backdoored updates. Notepad++ didn't regain control of its infrastructure until December.
Security firm Rapid 7 described the attack as a "custom, feature-rich backdoor" dubbed Chrysalis. According to experts, this is a sophisticated and permanent tool with a wide array of capabilities that indicate it was designed for long-term use, not a simple throwaway utility.
Experts believe that Notepad++'s update infrastructure was vulnerable due to insufficient update verification controls in older versions of the app. The hackers exploited these weaknesses to deliver malware-laced updates, including the Chrysalis backdoor.
According to independent researcher Kevin Beaumont, three organizations told him that devices inside their networks that had Notepad++ installed experienced "security incidents" that resulted in hands-on keyboard threat actors. These attackers were able to take direct control using a web-based interface.
Beaumont warned that search engines are "rammed full" of advertisements pushing trojanized versions of Notepad++, making it likely for users to unwittingly install malicious extensions and put their devices at risk.
Notepad++ developers have since urged all users to ensure they're running version 8.9.1 or higher installed manually from notepad-plus-plus.org. Experts recommend blocking notepad-plus-plus.org or the gup.exe process from having internet access for larger organizations, but caution that this may be overkill and impractical.
Users who want to investigate whether their devices have been targeted can refer to the indicators of compromise security post by Rapid 7.
In a shocking discovery, suspected China-state hackers have compromised the update infrastructure of popular free source code editor and note-taking app Notepad++. For six months, these hackers hijacked the update process, delivering a backdoored version of the app to select targets.
The attack began last June with an "infrastructure-level compromise" that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The hackers then selectively redirected certain targeted users to malicious update servers where they received backdoored updates. Notepad++ didn't regain control of its infrastructure until December.
Security firm Rapid 7 described the attack as a "custom, feature-rich backdoor" dubbed Chrysalis. According to experts, this is a sophisticated and permanent tool with a wide array of capabilities that indicate it was designed for long-term use, not a simple throwaway utility.
Experts believe that Notepad++'s update infrastructure was vulnerable due to insufficient update verification controls in older versions of the app. The hackers exploited these weaknesses to deliver malware-laced updates, including the Chrysalis backdoor.
According to independent researcher Kevin Beaumont, three organizations told him that devices inside their networks that had Notepad++ installed experienced "security incidents" that resulted in hands-on keyboard threat actors. These attackers were able to take direct control using a web-based interface.
Beaumont warned that search engines are "rammed full" of advertisements pushing trojanized versions of Notepad++, making it likely for users to unwittingly install malicious extensions and put their devices at risk.
Notepad++ developers have since urged all users to ensure they're running version 8.9.1 or higher installed manually from notepad-plus-plus.org. Experts recommend blocking notepad-plus-plus.org or the gup.exe process from having internet access for larger organizations, but caution that this may be overkill and impractical.
Users who want to investigate whether their devices have been targeted can refer to the indicators of compromise security post by Rapid 7.
. Leaving thousands of people vulnerable to attacks because they just didn't update Notepad++ properly? It's just basic common sense, you know? And now we're talking about Chrysalis, this "custom, feature-rich backdoor" that's basically a permanent security risk... it's just insane 
.
. It's like people think they're above getting scammed or compromised online.
.
I'm so not buying this. A state-backed hacker group compromising Notepad++? Come on! How did they even get past the update verification controls in older versions? 
I need sources on this one, folks! Who exactly is behind these attacks, and how far did they go with Chrysalis? 
Either way, it shows us that we need to be vigilant and take responsibility for our own online security. Can't just rely on the developers or security firms to keep us safe - gotta look out for ourselves too 
, not even realizing I might've been at risk of being hacked 
. But now that you mention it, I'll definitely be updating to the latest version and keeping a closer eye on what I'm downloading from the internet 
think about it, this could lead to some awesome bug bounty hunting opportunities for talented security researchers! and who knows, maybe this will push notepad++ devs to create even better security measures 
... back in the day, we had to manually download updates from a mirror server or wait for the dev team to push out new versions. Now, it's like China is just messing with our lives 
... hacked and compromised, who knew? 
... permanent tool with all these capabilities? Sounds super suspicious to me 
.
... until they realize their devices have been compromised 
. Anyway, devs did the right thing by pushing out a new version... now we just gotta make sure everyone's using it manually 
.
?
I'm totally freaked out about this Notepad++ hacking situation 
.
just read about notepad++ getting hacked by china-state hackers 
it's good that the devs are on top of it and fixing the issue ASAP 
and those Chinese hackers just exploited it like a pro