Robert GützkowDec 9
Kevin Beaumont

Notepad++ have released a new version to fix the auto update process being hijacked https://notepad-plus-plus.org/news/v889-released/

I reported the vulnerability, it is being hijacked by threat actors in China. https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9

Notepad++ v8.8.9 release: Vulnerability-fix | Notepad++

Dec 9 at 9:12pmWeb
Show threadKevin BeaumontDec 9
I hadn’t put the full details in the blog at the time, but the Notepad++ updater didn’t check if the update package was valid in any way - it just executed it. Also the update process used TLS.. but didn’t validate the session, so it could be hijacked to change the download.
Show threadKevin BeaumontDec 9
I did have a thread on this at the time but I think it auto deleted, whoops. It was being used for entry into telcos and financial services in East Asia anyhoo.
Show threadKevin BeaumontDec 9

Impacted boxes have things like FatBeehive and other tools installed, there’s hunting guides in that blog.

Notepad++ author really good btw, quick turn around.

Show threadKevin BeaumontDec 9
Also, long time followers may remember this one playing out in real time over the last few weeks - I just tooted about it in Follower mode to stop threat intel companies scraping the toots 🤣
Show threadKevin BeaumontDec 9
And yes, this was (and is) a supply chain attack - just everybody was too busy wacking off about GenAI and react2shell to notice.
Show threadKevin BeaumontDec 10
Since making this thread yesterday the infrastructure appears to have gone AWOL and they've nuked the DNS entries on the C2s etc etc. They had access to a bunch of orgs for 5 months, if anybody interested.
Show threadKevin BeaumontDec 10
I consulted the official #GAYINT threat actor mapping chart and made this diagram for Notepad++ hack attribution
Show threadKevin BeaumontFeb 2

Notepad++ have today confirmed their auto process was compromised by Chinese nation state threat actors, in a supply chain hack: https://notepad-plus-plus.org/news/hijacked-incident-info-update/

This backs up my blog from late last year, with #GAYINT threat actor mapping to Funky Stamen.

The infrastructure and update mechanisms have since been tightened. For what it’s worth - entry was to telcos and financial services with interests aligned to China. Notepad++ dev did a great job treating issue seriously.

Notepad++ Hijacked by State-Sponsored Hackers | Notepad++

Show threadKevin BeaumontFeb 2

Here’s my original blog with threat hunting suggestions: https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9

Of note - the cyber industry entirely slept through it. A cartoon porg with #GAYINT threat intelligence had to blow it up.

Small numbers of Notepad++ users reporting security woes

Auto updates are fun.

Medium
Show threadKevin BeaumontFeb 2

IOCs for Notepad++ auto update compromise. I have some more I’ll publish later.

You may notice I’d tagged the IOCs on VirusTotal as malicious months ago. https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit

Rapid7 Labs, together with the Rapid7 MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom.

Rapid7
Show threadKevin BeaumontFeb 3

Kaspersky have more new IOCs for the Notepad++ activity. It’s actually different activity clusters they identitied.

They’ve got most of the IOCs I’d found now although more to come.

https://securelist.com/notepad-supply-chain-attack/118708/

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

Kaspersky GReAT experts discovered previously undocumented infection chains used in the Notepad++ supply chain attacks. The article provides new IoCs related to those incidents which employ DLL sideloading and Cobalt Strike Beacon delivery.

Kaspersky
Show threadKevin BeaumontFeb 3

A fun one about the Notepad++ incident is, although my toots about it auto deleted (I have my toots set to auto delete unless I bookmark them), it was first revealed on the Fediverse in followers only mode a few months ago - I had a thread running for it back then.

When in follower only mode, the C2 infrastructure was still up so I was still able to track it - they only burnt it down when I wrote the blog. So follow me to see nation state espionage get live tooted, I guess.

Show threadDavid Penfold Feb 3

@GossiTheDog Dude, we know you're very good at what you do already, it's why we follow you!

Ok, that and Gossi Airways.

Show threadCryptoLek 🍉🌻Feb 3
@davep @GossiTheDog and balls
Show threadChrisFeb 5
@davep @GossiTheDog @CryptoLek
Show threadKetumbraFeb 3
@GossiTheDog surely they're following you now ;)
Show threadVessOnSecurityFeb 3

@GossiTheDog Reminds me that time when I fucked up a cyber operation of the Vietnamese intelligence...

(I didn't know that it was their operation at the time, to be honest.)

https://www.bleepingcomputer.com/news/security/new-iot-botnet-torii-uses-six-methods-for-persistence-has-no-clear-purpose/

New Iot Botnet Torii Uses Six Methods for Persistence, Has No Clear Purpose

Security researchers discovered a new IoT botnet that is in a league superior to the Mirai variants that rise and fall on a daily basis.

BleepingComputer
Show threadhal8999Feb 3
@GossiTheDog auto-deleted? Maybe that's why I can't find the stuff you were talking about. I remember your asking if anyone in Asia region was seeing anything. What countries did you see exploits or attempts to re-direct download traffic?
Show threadgunstickFeb 3
@GossiTheDog has anyone addressed the elephant in the room that notepad++ has to operate their own update server, instead of using a system provided one, like any good distribution does?
Show thread0xfediFeb 2
@GossiTheDog Shit good timing, was JUST about to post this for others as well haha! Thanks Kevin. Once you have some more throw'em in the medium post pretty please! Thanks for all the work you've done.
Show threadRairii   Feb 2
@GossiTheDog huh, one of the samples used the warbird syscall? lol
Show threadAlan Miller  🇺🇦Feb 2
@GossiTheDog thanks for posting things like this when they come to your attention. Prompted me to yank existing installs of Notepad++ from systems where they weren't actively in use and to get the update pushed as soon as it was available.
Show threadRonnyTNLFeb 2
@GossiTheDog still no IOC's?
Show thread0xfediFeb 2
@RonnyTNL did you find anything? I only have AutoUpdater.exe as the IoC thus far. Working with limited budget so no CTI's...
Show threadRonnyTNLFeb 2
@0x nope, there is way to much "AutoUpdater.exe" itw so unless there are hashes with is a goose chase.
Show thread0xfediFeb 2
@GossiTheDog Hey, any chances you can share some of the C2 IoC's or TTP's at least? Maybe the sha-256's identified, anything. We need them to understand and confirm the thesis that it was only East Asia that was affected. As you know notepad++ was installed by millions, in both personal and enterprise level.
Show threadRonnyTNLFeb 2

@GossiTheDog

Am I missing things or does this report not line up with your findings?

https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit

Rapid7 Labs, together with the Rapid7 MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom.

Rapid7
Show threadPete the Gopher KeeperFeb 2

@GossiTheDog

>For what it’s worth - entry was to telcos and financial services with interests aligned to China

Oh, that'll be the UK as well now, since Starmer's fallen into bed with Mr Xi. 😩

Show thread8tpercentFeb 2
@GossiTheDog https://hackingpassion.com/notepad-plus-plus-supply-chain-attack/
Notepad++ Supply Chain Attack Full Story

For six months, Notepad++ delivered malware instead of updates. Millions downloaded the infected version. This is how the attack worked and what to check on your systems.

HackingPassion.com : [email protected][~]
Show threadgunstickFeb 3
@GossiTheDog is this another argument in favor of distribution repositories? Instead of software developers needing to reinvent the wheel on how to securely distribute their software.
Show threadWordmarkDec 11
@GossiTheDog very funky
Show threadDirk HohndelDec 9

@GossiTheDog

I'm sure there's a way to spin this as a GenAI attack... PR nonsense by some AI security firm coming in 3...2..1..

Show thread波鉄 (Hatetsu)Dec 9
@GossiTheDog Surely if threat intel companies aren't following you, they aren't doing their jobs properly (well, we know they aren't)
Show threadrwhitworthDec 9
@GossiTheDog ah… this answers the question I had about TLS in the initial blog post. Also explains why I was mostly ignored 😆 Thank you for following up!
Show threadbenyameanDec 15
@GossiTheDog "used tls but didnt validate the session" - this means it accepted any TLS certificate? Or something more complex?
Show thread🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉Dec 9
@GossiTheDog I knew it 💪 :)
Show threadStu TomlinsonDec 9
@GossiTheDog hopefully the package validation is more robust than the URL validation added to the previous release which was easily subverted with path traversal
Show threadK~Dec 9

@GossiTheDog Scary stuff.

Notepad++ is great. It's a must-have app for me on Windows. But I also turn off auto-update on stuff like that. It bothers me when stuff that has no business using the internet tries to use the internet... so I tend to disable it out of principle. And for me I guess it paid off this time!

Show threadAmbient SpongeDec 10

@GossiTheDog Motherfuckers.

Good work my friend.

Show threadAnalog AIDec 10
@GossiTheDog Update is too important for every product to "roll their own". There needs to be a well defined, studied, and debugged API that is supported by all OSes and can be relied on to be secure.
Show threadLate Stage Mall-Emo RealismFeb 2
@GossiTheDog
classic case of fucking around and finding out