Notepad++ publishes a blog post saying they caught a probably-Chinese state actor hijacking their product in an attack against highly-selective targets that began last June: https://notepad-plus-plus.org/news/hijacked-incident-info-update/
Notepad++ Hijacked by State-Sponsored Hackers | Notepad++

@evacide

In the pages linked article at
https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ the mention of "undocumented system calls" in Microsoft Windows should serve as a warning not to use Windows at all, as it clearly can't be trusted. The cited name of one of those calls ("NtQuerySystemInformation") amused me by evoking memories of using Windows NT circa 1996.

Apparently Microsoft hasn't been adequately compelled to improve its products in the last 30 years.

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit

Rapid7 Labs, together with the Rapid7 MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom.

Rapid7