Lotus Blossom APT Compromises Notepad++ Updates to Deploy

Executive Summary

Rapid7 has attributed a six-month supply chain compromise of Notepad++ to the China-linked APT group Lotus Blossom. From June to December 2025, the attackers hijacked the Notepad++ hosting provider and selectively redirected update requests to deliver a previously undocumented backdoor called Chrysalis.

The attack targeted government organizations, IT service providers, and other entities in Vietnam, El Salvador, Australia, and the Philippines. The vulnerability has been patched in Notepad++ v8.8.9.

Attack Chain

How the Supply Chain Was Compromised

1. Lotus Blossom compromises Notepad++ hosting infrastructure
2. Attacker monitors incoming update requests via GUP.exe
3. Targeted requests selectively redirected to malicious server (95.179.213[.]0)
4. Malicious update.exe delivered via NSIS installer
5. Chrysalis backdoor installed alongside legitimate Notepad++ update
6. Backdoor contacts C2: api.skycloudcenter[.]com
7. Additional modules and commands received

Key Technical Details

Why This Attack Was Effective

The Notepad++ updater (GUP.exe) is a legitimate, signed component that runs automatically. By compromising the hosting infrastructure rather than the software itself, the attackers:

• Bypassed code signing verification (the installer was served from the legitimate update path)
• Avoided modifying the Notepad++ source code or binaries
• Could selectively target specific victims based on IP address or other request metadata
• Maintained the attack for six months without detection

The Chrysalis Backdoor

Capabilities

Communication Pattern

Chrysalis uses HTTPS to communicate with its C2 server, blending with normal web traffic. Initial beacon includes system fingerprint data; subsequent communications use encrypted command-and-response protocol.

Indicators of Compromise

Network Indicators

File System Indicators

• Unexpected files in Notepad++ installation directory
• Modified timestamps on GUP.exe update configuration
• NSIS installer artifacts in temporary directories
• Chrysalis DLL in application directory

Detection Recommendations

1. Check Notepad++ version — Any version below 8.8.9 should be updated immediately
2. Review DNS logs for connections to api.skycloudcenter[.]com
3. Check network logs for connections to 95.179.213[.]0
4. Scan for NSIS installer artifacts in temp directories from June–December 2025
5. Review Notepad++ installation directories for unexpected DLLs or executables

Who Is Lotus Blossom?

Lotus Blossom (also tracked as Spring Dragon, Thrip, Billbug) is a China-linked APT group active since at least 2009. The group primarily targets government, telecommunications, aviation, and media organizations in Southeast Asia.

Historical Campaigns

Lessons for Supply Chain Security

Why Developer Tools Are High-Value Targets

Notepad++ is one of the most widely used text editors, particularly popular among:

• Software developers who have access to source code and deployment systems
• System administrators who edit configuration files on production servers
• IT professionals who handle sensitive infrastructure documentation

Compromising a developer tool provides access to users who typically have elevated privileges and access to sensitive systems.

Mitigation Strategies

1. Pin software versions and validate update integrity via out-of-band checksums
2. Monitor update traffic for unexpected redirects or unfamiliar distribution servers
3. Use application allowlisting to prevent unauthorized executables from running
4. Segment developer workstations from production infrastructure
5. Deploy EDR with behavioral detection for post-exploitation activity
6. Subscribe to vendor security advisories for critical development tools

References

• Rapid7 — Chrysalis Backdoor Analysis
• Notepad++ v8.8.9 Release Notes
• MITRE ATT&CK — Supply Chain Compromise (T1195)

Related Reading

• Notepad++ Supply Chain Attack Attributed to China-Linked
• Dell RecoverPoint Zero-Day Exploited by Chinese APT Since
• UNC3886 Zero-Day Campaign: Singapore Telecom Operators