---
title: "Notepad++ Updater Hijack: State Actor Served Bad Updates"
url: https://erroneo.us/security/briefs/notepad-plus-plus-updater-hijack-cve-2025-15556/
description: "Attackers hijacked Notepad++ update traffic in 2025 to push backdoors to chosen targets. Old WinGUp lacked integrity checks. Update to v8.9.1+. In CISA KEV."
type: security-brief
section: "Security Digest"
date_published: 2026-02-02
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-15556"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Notepad++ Updater Hijack: State Actor Served Bad Updates

**Verdict: Check exposure.** Targeting was narrow (about a dozen machines in Kaspersky's telemetry), but any fleet that auto-updated Notepad++ between June and December 2025 should update to v8.9.1+ and check the published IoCs.

- **Who must act:** Organizations that ran Notepad++ before 8.8.9 with the built-in auto-updater during June-December 2025, especially government, financial, telecom and IT service providers in Southeast Asia and Central America.
- **Who can relax:** Individual users who simply update to v8.9.1 or later; the vendor and researchers say the vast majority of users were never targeted.
- **Affected:** Notepad++ before 8.8.9 using the WinGUp auto-updater
- **Fixed:** Notepad++ 8.8.9 (installer certificate and signature verification); Notepad++ 8.9.1 (vendor-recommended version, adds signed update XML)
- **CVEs:** CVE-2025-15556
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Update every Notepad++ install to v8.9.1 or later from notepad-plus-plus.org.
2. In managed fleets, deploy the MSI without the updater: msiexec /i npp.8.9.1.Installer.x64.msi NOUPDATER=1, and update through your own software distribution.
3. Check endpoint telemetry for the Rapid7 and Kaspersky IoCs covering July-December 2025.
4. Hunt for GUP.exe launching an unexpected update.exe or NSIS installer, and for %APPDATA%\ProShow directories.
5. Remove the old Notepad++ root certificate if you installed it before v8.8.7, as the vendor recommends.

### How to check if you are affected

- Query EDR for child processes of GUP.exe between June and December 2025, especially update.exe downloaded from raw IP addresses.
- Search for %APPDATA%\ProShow, ProShow.exe running from AppData, and curl uploads to temp.sh launched by unusual parents.
- Match file hashes, C2 IPs and domains against the Kaspersky Securelist and Rapid7 Chrysalis IoC lists.
- Look for whoami and tasklist output written to 1.txt by an installer process.

## What happened

On February 2, 2026, the Notepad++ maintainer [disclosed](https://notepad-plus-plus.org/news/hijacked-incident-info-update/) that attackers had compromised the project's former shared hosting provider. They used that access to redirect update traffic from selected users to malicious update manifests. The editor's code was not changed. The weak link was the WinGUp auto-updater, which before v8.8.9 did not cryptographically verify the update metadata or the installer it downloaded. That flaw is tracked as [CVE-2025-15556](https://nvd.nist.gov/vuln/detail/CVE-2025-15556) (CVSS 4.0 score 7.7, assigned by [VulnCheck](https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification)). CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556) on February 12, 2026.

The hosting provider's statement says the server was compromised until September 2, 2025. The attackers then kept credentials for internal services until December 2, 2025, which let them keep redirecting requests to the update endpoint. The maintainer puts the full window at June through December 2, 2025. [Rapid7](https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/) attributes the campaign to the Chinese APT group Lotus Blossom, which delivered a previously undocumented backdoor it calls Chrysalis. [Kaspersky](https://securelist.com/notepad-supply-chain-attack/118708/) documented three different infection chains between July and October 2025, ending in payloads such as Cobalt Strike Beacon.

## Who is affected

Technically, every Notepad++ install before 8.8.9 that used the built-in updater was exposed: anyone able to intercept or redirect its traffic could make it run an attacker's installer with the user's privileges. In practice, targeting was highly selective. Kaspersky saw about a dozen targeted machines: individuals in Vietnam, El Salvador and Australia, a government organization in the Philippines, a financial organization in El Salvador and an IT service provider in Vietnam. Rapid7 describes Lotus Blossom's usual targets as government, telecom, aviation, critical infrastructure and media organizations in Southeast Asia and Central America.

## Do you really need to act?

Everyone should update. That part is cheap. Whether you need to investigate depends on who you are. The [vendor's clarification](https://notepad-plus-plus.org/news/clarification-security-incident/) says "the vast majority of Notepad++ users were never affected" and that simply updating is enough for most people. Enterprises are a different case. Notepad++ is a common developer and admin tool, and the attackers chose victims for their strategic value. If you are in a targeted sector or region, or have staff who are, check your 2025 endpoint telemetry. This is also a general lesson: any updater that fetches code over the network without signature checks is a remote code path for whoever controls the network or the server.

## What to do now

1. Update to v8.9.1 or later, downloaded directly from notepad-plus-plus.org. [v8.8.9](https://notepad-plus-plus.org/news/v889-released/) made WinGUp verify the installer's certificate and signature and abort if the check fails. Later versions also sign the update XML (XMLDSig), and the maintainer said that check would become mandatory in v8.9.2.
2. In managed environments, install without the updater and push updates yourself: `msiexec /i npp.8.9.1.Installer.x64.msi NOUPDATER=1`.
3. Load the Rapid7 and Kaspersky IoCs into your EDR or SIEM and search back through June-December 2025.
4. If you installed the old self-signed Notepad++ root certificate, remove it. Binaries have been signed with a GlobalSign certificate since v8.8.7.

## How to tell if you were hit

The common thread in the research is `GUP.exe` (the updater) launching an unexpected `update.exe`, an NSIS installer downloaded from a raw IP address. Rapid7 saw one from 95.179.213.0, and Kaspersky saw one from 45.76.155[.]202. In one chain Kaspersky observed, the installer ran `cmd /c whoami&&tasklist > 1.txt`, uploaded the output to temp[.]sh with `curl.exe`, and dropped a legitimate but vulnerable `ProShow.exe` into `%APPDATA%\ProShow` to launch shellcode. Search for those artifacts and match hashes, IPs and domains against the published IoC lists. The maintainer's own incident response team reported finding no concrete IoCs in about 400 GB of hosting logs, so rely on endpoint data. On any confirmed hit, isolate and rebuild the machine and rotate the credentials it held.

## Timeline

- Jun 2025 — Compromise begins, by the maintainer's estimate.
- Sep 2, 2025 — The hosting provider says server access ended. The attackers keep service credentials.
- Dec 2, 2025 — The provider rotates credentials and attacker activity stops.
- Dec 9, 2025 — Notepad++ v8.8.9 adds installer certificate and signature verification.
- Feb 2, 2026 — The maintainer discloses the hijack and Rapid7 publishes its Chrysalis research. The CVE is published February 3, and Kaspersky's analysis follows.
- Feb 12, 2026 — CISA adds CVE-2025-15556 to KEV, due March 5.

## Sources

1. [Notepad++ — Notepad++ Hijacked by State-Sponsored Hackers (Feb 2, 2026)](https://notepad-plus-plus.org/news/hijacked-incident-info-update/)
2. [Notepad++ — Important Clarification: Notepad++ Security Incident (Feb 5, 2026)](https://notepad-plus-plus.org/news/clarification-security-incident/)
3. [Notepad++ — v8.8.9 release: Vulnerability-fix (Dec 9, 2025)](https://notepad-plus-plus.org/news/v889-released/)
4. [NVD — CVE-2025-15556](https://nvd.nist.gov/vuln/detail/CVE-2025-15556)
5. [CISA — Known Exploited Vulnerabilities Catalog: CVE-2025-15556](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556)
6. [VulnCheck — Notepad++ WinGUp updater lacks update integrity verification](https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification)
7. [Rapid7 — The Chrysalis Backdoor: A Deep Dive into Lotus Blossom's toolkit](https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/)
8. [Kaspersky Securelist — Notepad++ supply chain attack](https://securelist.com/notepad-supply-chain-attack/118708/)

---
Source page: https://erroneo.us/security/briefs/notepad-plus-plus-updater-hijack-cve-2025-15556/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt