Notepad ++ update infrastructure has been hijacked. A summary of IOCs searches

We have started this week with a very bad case. The hack of Notepad++.

If you don't know what is Notepad++, or don't see how critical such attack is, please move forward, and take some courses. Because, yes, this is a supply chain attack. One of the most dangerous attack an organization could suffer. Whatever is your level of security, if a trusted source, partner, provider etc is compromised, it becomes very hard to ensure the integrity of your infrastructure. We must in such case apply a zero trust logic, and the principles of Defense in Depth. In this case, it is actually worst, it is a 2 levels supply chain attack. The attackers compromised the notepad++'s provider hosting infrastructure, which was then used to compromise users of notepad++.

This post is written on Feb 3rd, at 11.00AM UTC+1. So all the information present here, are based on what is available at this time.

What happened ?

Quick summary of the initial incident from my understanding, based on the already published information.

The former hosting infrastructure of NPP used to update the client was compromised. How ? we don't really know yet. The threat actor, which seems to be a Chinese state sponsored actor, was able to redirect the update package download from NPP updater (gup.exe) to a malicious package. They did exploit a vulnerability in the update process, in which the updater did not validate the legitimacy of the update package (hash, signature, certificate etc). The target was selected by the threat actor on unknown criteria's.

What is the issue for you?

The incident started in June 2025 and lasted up to December 2025.

The log retention of a mature infrastructure mainly lead to have infrastructure level logs for this period, while endpoint logs (EDR/XDR) are most of the time shorter. So finding trace of the malicious actor starts to become complex.

But that's not all. We have almost no IOCs to search for. When the alert was triggered on Monday morning, my team and me was looking for... we did not know.

The previous legit packages of NPP was signed with a self signed certificate. We had the hashes of the legit installers we have collected from the official website, but no hashes of the running processes. The installer is downloaded only on installation. If it was a malicious one, it would have been 6 months ago.

Monday afternoon, Rapid7 has published a blog article, providing payload and infrastructure analysis with some IOCs. Are those IOCs exhaustive, we don't know. But it is a starting point.

Let's consider that you have a properly secured infrastructure. Which means :

-A proxy, mandatory for any internet access, or at least an URL filtering at your boundaries, with SSL inspection, and full details logs. So you have the user-agent, the filenames, the hash of downloaded files, the full URI etc

-A sufficient log retention for your proxy logs, and firewall logs.

-An EDR. In my case, we'll do the searches in MS Defender for Endpoint, which brings me the limit of 30 days hot logs. 😭

I share with you my elements, my searches.

Extracted IOCs from multiple sources

Resources

https://securelist.com/notepad-supply-chain-attack/118708/

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit

Exploring the C2 Infrastructure of the Notepad++ Compromise | Validin

Payloads SHA256:

• 8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e

• 2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924

• 77bfea78def679aa1117f569a35e8fd1542df21f7e00e27f192c907e61d63a2e

• 3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad

• 0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd

• 4c2ea8193f4a5db63b897a2d3ce127cc5d89687f380b97a1d91e0c8db542e4f8

• e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda

• 078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5

• b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3

• 7add554a98d3a99b319f2127688356c1283ed073a084805f14e33b4f6a6126fd

• fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a

• a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9

• 9276594e73cda1c69b7d265b3f08dc8fa84bf2d6599086b9acc0bb3745146600

• f4d829739f2d6ba7e3ede83dad428a0ced1a703ec582fc73a4eee3df3704629a

• 4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906

• 831e1ea13a1bd405f5bda2b9d8f2265f7b1db6c668dd2165ccc8a9c4c15ea7dd

• c7cc87ef3829a33b7f178d88a71ba548c37020005b09d16a76fcd356621335e6

• 36c98c18215a244e501673d9f01fa093d1906d08a7ad9927905f8f004640e4e1

• 4d4aec6120290e21778c1b14c94aa6ebff3b0816fb6798495dc2eae165db4566

KQL file events

DeviceFileEvents

| where SHA256 in ("8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e",

"2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924",

"77bfea78def679aa1117f569a35e8fd1542df21f7e00e27f192c907e61d63a2e",

"3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad",

"0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd",

"4c2ea8193f4a5db63b897a2d3ce127cc5d89687f380b97a1d91e0c8db542e4f8",

"e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda",

"078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5",

"b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3",

"7add554a98d3a99b319f2127688356c1283ed073a084805f14e33b4f6a6126fd",

"fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a",

"a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9",

"9276594e73cda1c69b7d265b3f08dc8fa84bf2d6599086b9acc0bb3745146600",

"f4d829739f2d6ba7e3ede83dad428a0ced1a703ec582fc73a4eee3df3704629a",

"4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906",

"831e1ea13a1bd405f5bda2b9d8f2265f7b1db6c668dd2165ccc8a9c4c15ea7dd",

"c7cc87ef3829a33b7f178d88a71ba548c37020005b09d16a76fcd356621335e6",

"36c98c18215a244e501673d9f01fa093d1906d08a7ad9927905f8f004640e4e1",

"4d4aec6120290e21778c1b14c94aa6ebff3b0816fb6798495dc2eae165db4566")

KQL process events

DeviceProcessEvents