This application supports multiple coding languages as well as plugins that automate a number of IT and development related tasks. Notepad++ is a very popular Notepad replacement and code editor created and maintained by Don Ho.

Detected and Prevented by Cybereason MDR (Managed Detection and Response): The Cybereason Defense Platform effectively detects and prevents infections from malware loaded in a malicious Notepad++ plugin.

Absence of Verification Process in Notepad++: No verification process has been observed for locally installed plugins, allowing threat actors with local administrator privileges to inject their own malicious DLL in the loading process.

Advanced Plugin Feature: Notepad++ has an advanced plugin mechanism that can be leveraged by threat actors for persistence and security evasion.Threat Actors Have Already Abused Notepad++: APT groups, like StrongPity, have been observed leveraging Notepad++ to deploy backdoors on their victims’ machine.

Popularity Can Lead to Increased Attack Surface: Notepad++ is an extremely popular tool that is installed in almost every IT-related environment.The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. The Threat Analysis Reports investigate these threats and provide practical recommendations for protecting against them. The Cybereason Global Security Operations Center (GSOC) Team issues Threat Analysis Reports to inform on impacting threats. This particular Threat Analysis report is part of a series named “Purple Team Series” covering widely used attack techniques, how threat actors are leveraging them and how to detect their use. Following this introduction, we describe in detail how to reproduce this attack and implement detection and prevention mechanisms. Cybereason GSOC team analysts have analyzed a specific technique that leverages Notepad++ plugins to persist and evade security mechanisms on a machine.

Install notepad++ no admin permissions