BreachWatch™: Notepad++ update infrastructure compromise (Chrysalis)

February 2026

• Incident type: Supply-chain / update-delivery infrastructure compromise (hosting-provider layer), with selective redirection of update traffic.

• Operational impact: Targeted users who updated via the built-in updater could be served trojanized installers from attacker-controlled servers (not a Notepad++ source-code compromise)

• Malware delivered: A custom backdoor dubbed “Chrysalis” (plus additional tooling reported by responders).

• Timeline: ~June–December 2025, with attacker access evolving over time (initial hosting compromise, then retained access via credentials).

• Attribution (reported): Researchers and reporting attribute the campaign to a China-linked group commonly tracked as Lotus Blossom (a.k.a. Billbug / Lotus Panda)

Why it matters: This is the supply-chain failure mode teams routinely miss: distribution and update plumbing can become the attack surface – even when the software project itself isn’t compromised.

What happened

Notepad++’s update traffic was hijacked through a compromise at the hosting-provider / update-delivery infrastructure layer. Rather than exploiting a bug in the Notepad++ codebase, the threat actor selectively redirected update requests from certain targeted users to attacker-controlled servers that delivered malicious installers.

Public reporting places activity beginning around June 2025 and persisting for months, with full cutoff occurring in early December 2025 – a long dwell time for an update-path compromise.

Researchers and reporting attribute the campaign to the China-linked espionage group Lotus Blossom, and describe the delivered backdoor as Chrysalis.

VRM takeaways

• “Trusted software” can be an untrusted delivery channel.
  If the update mechanism or the infrastructure behind it can be redirected, a legitimate product becomes a distribution vector – without touching source code.
• Targeted supply-chain attacks won’t look “big” until they hit you.
  Selective redirection reduces noise and can evade broad telemetry, which is why monthslong compromise windows are possible.
• Questionnaires don’t cover real exposure.
  A vendor can “pass” controls on paper while their delivery dependencies (hosting, CDNs, update scripts, signing/verification paths) remain fragile – or unverified.

How Perimeter helps in incidents like this

Perimeter is built for supply-chain moments where speed and evidence matter more than assumptions. Here’s how the platform maps to the exact failure modes in this incident:

1. Monitor the blast radius (fast)

• Identify which teams, endpoints, and vendor relationships depend on a given tool – and how it’s distributed (direct download vs. built-in updater, managed packaging, etc.).
• Track breach and threat signals tied to the vendor and its infrastructure providers so reassessment triggers automatically, not ad hoc.

2. Verify what’s true (not just what’s claimed)

• Correlate external signals (incident reporting, threat research, infrastructure indicators) against vendor statements – so “we’re not affected” becomes validated, not assumed.

3. Extract the facts from messy disclosures

• Turn advisory writeups and vendor notices into structured fields: timeline, affected update paths, indicators, required customer actions, and evidence requests – so your team moves in hours, not days.

4. Assess impact in context

• Score risk based on your actual dependency and exposure (who uses it, where it runs, what it touches), not generic severity.

5. Share an “impact check” that’s auditable

• Send a standardized outreach to internal stakeholders and external vendors (if relevant) to confirm:
  • whether Notepad++ is present,
  • whether the built-in updater was used in the window,
  • whether any detections or suspicious updater behavior occurred,
  • and what remediation evidence exists.

6. Respond to closure (with proof)

• Orchestrate remediation tasks (upgrade paths, endpoint validation, logging review, evidence capture) with owners, due dates, and artifacts – so you can answer: who was exposed, what changed, and what’s still open.

Immediate response checklist (use now)

If you have vendors with access to sensitive customer data:

1. Scope usage: Confirm where Notepad++ is installed and how it’s updated (built-in updater vs. managed packaging vs. direct download).
2. Contain and harden: Ensure endpoints are on versions with improved update verification where applicable, and prefer controlled software distribution channels.
3. Hunt for signs of updater abuse: Review endpoint telemetry around update events during June–December 2025 and investigate anomalies (unexpected installer execution, unusual network destinations during update flows).
4. Document everything: Capture what you checked, what you found, and what you changed – so you have defensible evidence for leadership, auditors, and incident response.

How Perimeter helps (mapped to this scenario)

• Monitor: Continuous vendor signals so you’re not waiting on vendor updates to detect elevated risk.
• Assess: Align vendor tiering and review depth to real access/criticality (especially when SSNs are in play).
• Verify: Validate vendor claims against independent signals and evidence – surface gaps faster.
• Extract + Share: Centralize requests and supporting documentation, reduce back-and-forth, and keep everything searchable.
• Respond: Run structured incident outreach and tracking so time-to-clarity doesn’t drag on.

Bottom line

This wasn’t an open-source code flaw – it was a trust failure in the distribution pipeline. By compromising the hosting/update infrastructure and selectively redirecting traffic, attackers turned a widely used tool into a targeted delivery mechanism.

Modern supply-chain risk isn’t just about what software you use – it’s about where and how it’s delivered. Perimeter helps you see the dependency, validate real signals, and drive response to closure – with proof.