Notepad++ Vulnerability Checker (Feb-2026)
PowerShell script to check Windows machines for indicators of compromise from the Notepad++ supply chain attack (June - December 2025) attributed to Lotus Blossom APT.
The attack hijacked Notepad++ update infrastructure to deliver the Chrysalis backdoor. Patched in Notepad++ v8.8.9 (December 2025).
Usage
# Basic scan
powershell -ExecutionPolicy Bypass -File chrysalis_check.ps1
# Extended scan (also checks Downloads, Temp, ProgramData)
powershell -ExecutionPolicy Bypass -File chrysalis_check.ps1 -DeepHashScan
# Save results to file
powershell -ExecutionPolicy Bypass -File chrysalis_check.ps1 -NoColor > results.txt
The script is read-only and does not modify your system. Exit code 0 = clean, 1+ = ale…
Notepad++ Vulnerability Checker (Feb-2026)
PowerShell script to check Windows machines for indicators of compromise from the Notepad++ supply chain attack (June - December 2025) attributed to Lotus Blossom APT.
The attack hijacked Notepad++ update infrastructure to deliver the Chrysalis backdoor. Patched in Notepad++ v8.8.9 (December 2025).
Usage
# Basic scan
powershell -ExecutionPolicy Bypass -File chrysalis_check.ps1
# Extended scan (also checks Downloads, Temp, ProgramData)
powershell -ExecutionPolicy Bypass -File chrysalis_check.ps1 -DeepHashScan
# Save results to file
powershell -ExecutionPolicy Bypass -File chrysalis_check.ps1 -NoColor > results.txt
The script is read-only and does not modify your system. Exit code 0 = clean, 1+ = alerts found.
Note: This is a quick triage tool that checks for known, published IoCs only. It does not scan memory, detect behavioral patterns, or replace a proper EDR/AV solution. A clean result means none of the known static indicators were found — it does not guarantee your system is uncompromised. If you have reason to believe you were targeted, use a full endpoint security tool and consult your incident response team.
What it checks
| # | Check | What it looks for |
|---|---|---|
| 1 | Drop directory | %AppData%\Bluetooth (Chrysalis staging folder) |
| 2 | C2 connections (TCP) | Active connections to known C2 IPs |
| 3 | C2 connections (netstat) | Any protocol connections to C2 IPs |
| 4 | DNS cache | Resolved C2 domains |
| 5 | Hosts file | C2 domain entries |
| 6 | Notepad++ version | Installed version below 8.8.9 (vulnerable) |
| 7 | Registry Run keys | Persistence in HKLM/HKCU Run and RunOnce |
| 8 | Scheduled tasks | Persistence via task scheduler |
| 9 | Windows services | Suspicious BluetoothService in AppData |
| 10 | Running processes | BluetoothService, ConsoleApplication2, s047t5g |
| 11 | Malicious filenames | Known filenames in user directories |
| 12 | SHA-256 hash scan | All exe/dll/bat in AppData checked against 16 known hashes |
Indicators of compromise (IoCs)
All indicators sourced from Rapid7 Labs.
File indicators
| File | SHA-256 | Description |
|---|---|---|
| update.exe | a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9 | Malicious NSIS installer delivered via hijacked Notepad++ update |
| [NSIS.nsi] | 8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e | Installation script extracted from NSIS installer |
| BluetoothService.exe | 2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924 | Renamed Bitdefender binary used for DLL sideloading |
| BluetoothService | 77bfea78def679aa1117f569a35e8fd1542df21f7e00e27f192c907e61d63a2e | Encrypted shellcode blob (Chrysalis payload) |
| log.dll | 3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad | Malicious DLL sideloaded by BluetoothService.exe |
| u.bat | 9276594e73cda1c69b7d265b3f08dc8fa84bf2d6599086b9acc0bb3745146600 | Batch script for cleanup/persistence |
| conf.c | f4d829739f2d6ba7e3ede83dad428a0ced1a703ec582fc73a4eee3df3704629a | Embedded Metasploit shellcode, compiled via TCC at runtime |
| libtcc.dll | 4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906 | Tiny C Compiler library used to compile conf.c |
| admin | 831e1ea13a1bd405f5bda2b9d8f2265f7b1db6c668dd2165ccc8a9c4c15ea7dd | Cobalt Strike beacon from api.wiresguard.com |
| loader1 | 0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd | Intermediate loader |
| uffhxpSy | 4c2ea8193f4a5db63b897a2d3ce127cc5d89687f380b97a1d91e0c8db542e4f8 | Intermediate loader |
| loader2 | e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda | Second-stage loader |
| 3yzr31vk | 078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5 | Second-stage loader |
| ConsoleApplication2.exe | b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3 | Warbird loader abusing Microsoft Warbird framework |
| system | 7add554a98d3a99b319f2127688356c1283ed073a084805f14e33b4f6a6126fd | Additional payload |
| s047t5g.exe | fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a | Additional payload |
Network indicators
| Indicator | Type |
|---|---|
95.179.213.0 | Payload download server |
61.4.102.97 | C2 IP (api.skycloudcenter.com) |
59.110.7.32 | Infrastructure IP |
124.222.137.114 | Infrastructure IP |
api.skycloudcenter.com | Primary C2 domain (Chrysalis) |
api.wiresguard.com | Secondary C2 domain (Cobalt Strike) |
MITRE ATT&CK
| ID | Technique |
|---|---|
| T1204.002 | User Execution: Malicious File |
| T1036 | Masquerading |
| T1027 | Obfuscated Files or Information |
| T1027.007 | Dynamic API Resolution |
| T1140 | Deobfuscate/Decode Files or Information |
| T1574.002 | DLL Side-Loading |
| T1106 | Native API |
| T1055 | Process Injection |
| T1620 | Reflective Code Loading |
| T1059.003 | Windows Command Shell |
| T1083 | File and Directory Discovery |
References
- Rapid7 — The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit
- Notepad++ — Hijacked Incident Info Update
- Kaspersky/Securelist — Notepad++ Supply Chain Attack
License
MIT