Kaspersky uncovers hidden attack chains in Notepad++ supply chain compromise
Kaspersky Global Research and Analysis Team (GReAT) researchers have uncovered a Notepad++ supply-chain compromise that, while observed in organizations across Asia and Latin America, highlights a risk equally relevant to Middle East governments, financial institutions and service providers that rely on widely used software tools.
GReAT researchers discovered that attackers targeted a government organization in the Philippines, a financial institution in El Salvador, an IT service provider in Vietnam and individuals across three countries using at least three distinct infection chains — two of which remain unknown to the public.
The attackers completely overhauled their malware, command-and-control infrastructure and delivery methods roughly every month between July and October 2025. The single attack chain publicly documented to date represents only the final phase of a much longer and more sophisticated campaign.
The Notepad++ developers disclosed on February 2, 2026, that their update infrastructure had been compromised due to a hosting provider incident. Previous public reporting focused exclusively on malware observed in October 2025, leaving organizations unaware of the entirely different indicators of compromise used from July through September.
Each chain used different malicious IP addresses, domain names, execution methods and payloads. Organizations that scanned only for the October indicators may have missed earlier infections entirely. Kaspersky solutions blocked all identified attacks as they occurred.
“Defenders who checked their systems against the publicly known IoCs and found nothing should not assume they’re in the clear,” said Georgy Kucherin, senior security researcher at Kaspersky GReAT. “The July-September infrastructure was completely different — different IPs, different domains, different file hashes. And given how frequently these attackers rotated their tooling, we cannot rule out the existence of additional, as-yet-undiscovered chains.“
While the confirmed victims were located outside the Middle East, the campaign’s characteristics mirror the exact threat models facing Middle East governments, banks and critical service providers. The region’s heavy reliance on widely used developer and IT administration tools, combined with accelerated digital transformation initiatives, makes similar supply-chain attacks both plausible and difficult to detect.
For organizations in the Middle East, the campaign serves as a warning that geographically distant incidents can still expose blind spots in software trust, update verification and long-term threat hunting, Kaspersky experts observed.
Kaspersky GReAT has published the full list of indicators of compromise, including six malicious updater hashes, 14 C2 URLs and eight malicious file hashes not previously reported. The complete IoC list and technical analysis are available at Securelist.
