NATION-STATE ACTORS EXPLOIT NOTEPAD++ SUPPLY CHAIN

Summary from the TLDR InfoSec newsletter

Lotus Blossom compromised the Notepad++ hosting infrastructure between June and December 2025, hijacking the update server to selectively serve malicious installers to targets across government, telecom, and critical infrastructure sectors in Southeast Asia, South America, the US, and Europe. The attack delivered two infection chains — a Lua script injection variant deploying Cobalt Strike beacons and a DLL sideloading variant using a renamed Bitdefender component to load the Chrysalis backdoor with Warbird-protected evasion techniques. Users should manually update to Notepad++ v8.9.1 or later, which includes certificate and signature verification for downloaded installers.