A sophisticated cyber attack has been discovered that compromised the update infrastructure for Notepad++, a widely used free source code editor and note-taking app for Windows. The attackers, suspected to be state-backed hackers from China, successfully delivered a backdoored version of the app to select targets, compromising their security.
The attack began in June with an "infrastructure-level compromise" that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. Once inside, the attackers selectively redirected certain targeted users to malicious update servers where they received compromised updates. Notepad++ didn't regain control of its infrastructure until December.
Security firm Rapid 7 described a never-before-seen payload dubbed Chrysalis as a "custom, feature-rich backdoor" that was installed by the attackers. The researchers noted that Chrysalis is a sophisticated tool with a wide array of capabilities, indicating it's a permanent and powerful hacking instrument rather than a simple throwaway utility.
The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls in older versions of the app. They tried to re-exploit one of the weaknesses after it was fixed but failed.
Independent researcher Kevin Beaumont warned that devices with Notepad++ installed experienced "security incidents" resulting from hackers taking direct control using a web-based interface. Three organizations, all with interests in East Asia, confirmed that they were affected by these security incidents.
Beaumont advised users to ensure they're running the official version 8.8.8 or higher installed manually from notepad-plus-plus.org, and recommended larger organizations block Notepad++ updates or the gup.exe process from having internet access.
In recent months, Microsoft has integrated Copilot AI into Notepad, drawing even more interest in the app. However, like many open-source projects, funding for Notepad++ is dwarfed by its reliance on it, leaving vulnerabilities that could have been caught and fixed with sufficient resources.
The attack began in June with an "infrastructure-level compromise" that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. Once inside, the attackers selectively redirected certain targeted users to malicious update servers where they received compromised updates. Notepad++ didn't regain control of its infrastructure until December.
Security firm Rapid 7 described a never-before-seen payload dubbed Chrysalis as a "custom, feature-rich backdoor" that was installed by the attackers. The researchers noted that Chrysalis is a sophisticated tool with a wide array of capabilities, indicating it's a permanent and powerful hacking instrument rather than a simple throwaway utility.
The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls in older versions of the app. They tried to re-exploit one of the weaknesses after it was fixed but failed.
Independent researcher Kevin Beaumont warned that devices with Notepad++ installed experienced "security incidents" resulting from hackers taking direct control using a web-based interface. Three organizations, all with interests in East Asia, confirmed that they were affected by these security incidents.
Beaumont advised users to ensure they're running the official version 8.8.8 or higher installed manually from notepad-plus-plus.org, and recommended larger organizations block Notepad++ updates or the gup.exe process from having internet access.
In recent months, Microsoft has integrated Copilot AI into Notepad, drawing even more interest in the app. However, like many open-source projects, funding for Notepad++ is dwarfed by its reliance on it, leaving vulnerabilities that could have been caught and fixed with sufficient resources.
just heard about this cyber attack on Notepad++ and I'm shook 
. Can you believe they were able to compromise the update infrastructure? It's like they had a key to the entire app 
. And it's not just that they got in, but also how long it took for Microsoft to regain control - December! That's ages in tech time 
.
. And now with Copilot AI integrated into Notepad, I hope Microsoft is paying extra attention to its security 
.
. Maybe this attack is a wake-up call for developers and users alike to take their software security more seriously 
?
I'm low-key freaking out about this one... A cyber attack as sophisticated as this should've been caught by the devs or Microsoft ASAP! 
. I'm all for free resources, but if you're gonna be that vulnerable, at least have a solid budget to back it up 
). It seems like Notepad++ has been pretty lax on update security for a while. They gotta revamp their system ASAP! 
And now there's this custom backdoor called Chrysalis... it sounds super sneaky! 
Maybe we should all just stick to paid apps for now... 
! The attackers got away with a custom backdoor called Chrysalis 
. I mean, who needs that kind of hacking power? 
.
and manual updates from now on 
I'm lowkey worried about this whole thing... Like, I've used Notepad++ all the time to write code, and now I'm not sure if my updates are legit anymore 
. I know Beaumont said to update manually, but that's a hassle... and what about when the updates stop coming altogether? 
Not to mention, Microsoft just integrated Copilot AI into Notepad - now that's some advanced tech right there 
This cyber attack on Notepad++ is a stark reminder of how vulnerable we are to state-backed hackers 
. I mean, who would've thought that one of the most widely used free source code editors and note-taking apps for Windows could be compromised in such a way? 
.
? Like, what's next, they'll be selling 'em on the black market for a few bucks? 
. I mean, I know Notepad++ is old school, but come on, can't we afford a decent security team for once? 
.
. With Copilot AI integrated into Notepad, it's like they're saying "let's make it easier for hackers to get in" 
. Until then, users will continue to be at risk 
They managed to sneak a backdoor into Notepad++, which is like, a totally innocent app that just lets you write code and take notes... I'm surprised they didn't go after something more important, like their government's secret documents or something! 
I guess it's good for them to be interested in AI, but at the same time... 
It just goes to show how easy it is to get caught out if you don't have the resources to keep up with security patches.
And hey, maybe this will be a wake-up call for developers and users alike to prioritize security over cost-cutting measures. 
. I mean, notepad++ is a free app, everyone's supposed to be secure... kinda like how we used to think about Windows updates back in the day 
. Anyway, it's not just Notepad++ that's got me worried - what's going on with all these state-backed hackers? It feels like they're getting more brazen by the minute 
I mean, it's a game changer for productivity. but at the same time, I'm like... if they're gonna make it more secure and stable, they need to invest in some serious resources 
it's no wonder there are vulnerabilities in notepad++ and other open-source projects.
. it's clear that whoever did this was after more than just a quick hack... they wanted to create a permanent backdoor