CVE-2025-56383Active Exploitation

LOWCVSS 8.4 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-427

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 2 classified signals
2 mentions across 1 observed day

What's happening

Active exploitation reported across 2 signals
Technical details provided in 2 signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Active Exploitation

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc91d
Active Exploitation
TRC analysis shows UAC-0099 weaponizing legitimate Notepad++ plugins to deploy MATCHBOIL.V2 malware against Ukrainian organizations. Attackers exploited CVE-2025-56383 to execute code via DLL hijacking, then established persistence through scheduled tasks. Runtime segmentation helps contain such post-compromise lateral movement. #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/fake-notepad-plugin-delivers-matchboil-v2-in-uac-0099-attacks
Post summary
The report confirms that attackers weaponized a legitimate Notepad++ plugin to deliver MATCHBOIL.V2 malware by exploiting CVE‑2025‑56383 through DLL hijacking, and achieved persistence via scheduled tasks.
0000058
1.9K followersView on X
Aviatrix Threat Research Center@aviatrixtrc91d
Active Exploitation
TRC analysis shows UAC-0099 (APT44/Sandworm) used malicious Notepad++ plugins to establish persistence and move laterally within Ukrainian networks. The campaign leveraged CVE-2025-56383 DLL hijacking to execute LunchPoke and BurnyBear payloads. Runtime segmentation helps contain such post-compromise lateral movement. #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware-2026
Post summary
The analysis indicates that APT44/Sandworm exploited CVE‑2025‑56383 via malicious Notepad++ plugins, using DLL hijacking to obtain persistence and move laterally, actively executing LunchPoke and BurnyBear payloads.
0000043
1.9K followersView on X

Explore more

Back to dashboard