Notepad++ Supply Chain Attack: What Houston Businesses Need to Know About the 2025 Chrysalis Malware Campaign
Introduction
The cybersecurity landscape shifted dramatically in late 2025 when researchers uncovered a sophisticated supply chain attack targeting Notepad++, one of the most popular text editors in the world with over 10 million active users. This was not a typical malware campaign—it was a state-sponsored operation that silently compromised update servers for six months, delivering custom malware to carefully selected targets across telecommunications, government, and financial sectors.
For Houston businesses relying on open-source software tools, this attack serves as a critical wake-up call about the hidden dangers lurking in software supply chains. In this comprehensive guide, we will break down exactly what happened, who was behind it, and most importantly, what steps your organization should take to protect against similar threats.
What Happened: The Notepad++ Supply Chain Compromise
Between June and December 2025, a China-linked threat actor successfully infiltrated the infrastructure hosting Notepad++, enabling them to intercept and redirect legitimate software update requests to malicious servers under their control. Unlike traditional malware attacks that exploit vulnerabilities in the software code itself, this campaign targeted the trust relationship between users and their software update mechanisms.
When users ran the built-in WinGUP updater—a routine action that millions perform without a second thought—their requests were occasionally routed to attacker-controlled servers. These servers delivered malicious installers masquerading as legitimate Notepad++ updates, which then deployed a previously unknown backdoor called Chrysalis.
Who Was Behind the Attack
Security researchers at Rapid7 attributed the campaign to Lotus Blossom (also known as Billbug), a Chinese APT group active since 2009. This group conducts espionage operations targeting government agencies, telecommunications providers, and critical infrastructure across Southeast Asia and Central America. Independent researcher Kevin Beaumont connected the attack to Violet Typhoon (APT31/Zirconium).
Inside the Chrysalis Backdoor
The Chrysalis malware implements 16 distinct command functions including interactive reverse shell access, remote process execution, comprehensive file operations, file transfer protocols for data exfiltration, drive enumeration, and self-removal functionality. It uses Microsoft Warbird code protection framework for obfuscation, DLL sideloading, custom API hashing, and mimics legitimate Deepseek API traffic patterns.
Indicators of Compromise
Network indicators include traffic to 95.179.213.0, connections to api.skycloudcenter[.]com and api.wiresguard[.]com, and communications with Malaysian IP 61.4.102.97. Host-based indicators include hidden directories under AppData containing executables, BluetoothService.exe in unexpected locations, a specific mutex identifier, and unexpected registry modifications.
Remediation Steps
Update Notepad++ to version 8.8.9 or later immediately. Audit systems for compromise if Notepad++ was used between June and December 2025. Implement software composition analysis tools, network segmentation, zero trust architecture, and modern EDR solutions. Monitor for behavioral anomalies and subscribe to security advisories for critical applications.
How LayerLogix Can Help
At LayerLogix, we help Houston businesses implement comprehensive security strategies including 24/7 Security Monitoring, Endpoint Detection and Response (EDR), Software Asset Management, Security Awareness Training, and Incident Response Planning. Contact us today to strengthen your cybersecurity posture against nation-state threats.
Related Articles
Need Expert IT Support?
Let our team help your Houston business with enterprise-grade IT services and cybersecurity solutions.