Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group

Attribution to Lotus Blossom

A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++. New findings from Rapid7 indicate that this attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to users of the open-source editor.

Hijacked Update Traffic

Notepad++ maintainer Don Ho stated that a compromise at the hosting provider level allowed threat actors to hijack update traffic starting in June 2025. The attackers selectively redirected requests from certain users to malicious servers to serve a tampered update by exploiting insufficient update verification controls that existed in older versions of the utility. This weakness was plugged in December 2025 with the release of version 8.8.9. The hosting provider breach allowed targeted traffic redirections until December 2, 2025, when the attacker's access was terminated. Notepad++ has since migrated to a new hosting provider with stronger security and rotated all credentials.

Analysis of the Malicious Payload

Rapid7's analysis of the incident uncovered no evidence that the updater-related mechanism was exploited to distribute malware. Security researcher Ivan Feigl noted that the only confirmed behavior involved the execution of 'notepad++.exe' and subsequently 'GUP.exe,' which preceded the execution of a suspicious process named 'update.exe' downloaded from 95.179.213.0. This executable is a Nullsoft Scriptable Install System (NSIS) installer containing an NSIS installation script, an encrypted shellcode known as Chrysalis, a malicious DLL named log.dll used for decryption and execution, and BluetoothService.exe. The latter is a renamed version of the Bitdefender Submission Wizard used for DLL side-loading, a technique widely used by Chinese hacking groups.

Chrysalis Implant Capabilities

Chrysalis is described as a bespoke, feature-rich implant designed to gather system information and contact an external server at api.skycloudcenter[.]com to receive additional commands. Although the command-and-control server is currently offline, a deeper examination of the obfuscated artifact revealed capabilities to process incoming HTTP responses to spawn an interactive shell, create processes, perform file operations, upload or download files, and uninstall itself.

Evolving Tradecraft and Tools

The sample appears to have been actively developed over time. Rapid7 identified a file named conf.c designed to retrieve a Cobalt Strike beacon using a custom loader that embeds Metasploit block API shellcode. One loader, ConsoleApplication2.exe, utilizes Microsoft Warbird, an undocumented internal code protection framework, to execute shellcode. The threat actor was found to have copied and modified a proof-of-concept published by Cirosec in September 2024. Rapid7 attributes Chrysalis to

Lotus Blossom—also known as Billbug, Bronze Elgin, Raspberry Typhoon, Spring Dragon, and Thrip—based on similarities with prior campaigns, including an April 2025 incident documented by Symantec. The group utilizes a mix of custom malware like Chrysalis, commodity frameworks like Metasploit, and rapid adaptation of public research such as the abuse of Microsoft Warbird.