UAC-0099 — LUNCHPOKE / BURNYBEAR via Notepad++ Plugin Loading

What happened, why it defeats ordinary controls, and what a hunter should actually go looking for.

CERT-UA published advisory 6318634 on 2026-07-21 describing a change in tradecraft for the threat cluster it tracks as UAC-0099 — a Russia-aligned actor active since at least mid-2022, previously known for weaponising WinRAR flaws to deliver LONEPAGE and for the MATCHBOIL / MATCHWOK / DRAGSTARE toolset, and reported to have provided initial access for APT44 (Sandworm). The new chain replaces exploitation with abuse of a completely legitimate feature.

The victim receives a phishing email whose image attachment carries the hyperlink. Clicking it walks a URL shortener out to a consumer file-transfer service, which serves a ZIP. Inside is a VBScript padded with a long run of spaces before its real .vbs extension so the file list shows a PDF. Running it opens a decoy PDF in the foreground while, in the background, it pulls a second archive, Evernote.zip, containing a complete, unmodified copy of Notepad++ 8.8.3, a rogue NppExport.dll in the plugins\NppExport\ directory, a password-protected updater.rar, and a legitimate winrar.exe. The script unpacks that into a randomly named directory under the public profile and starts Notepad++. Notepad++ loads the plugin because that is what Notepad++ does.

From there the chain is entirely living-off-its-own-bundle:

• LUNCHPOKE (NppExport.dll) creates a working directory under %PUBLIC%\Libraries\, uses the bundled WinRAR to unpack updater.rar with a password, drops RemoteLibUpdater.exe and InitTest.dll, copies schtasks.exe to %PUBLIC%\Wallpapers\Background.exe, and registers a scheduled task that runs the loader with the arguments setup nodisplay every three minutes.
• BURNYBEAR (RemoteLibUpdater.exe) exists only to load InitTest.dll. Run it with no arguments and it deliberately burns RAM and CPU instead — a combined anti-analysis and sandbox-detection trick, since automated detonation usually launches a binary bare.
• MATCHBOIL.V2 (InitTest.dll) is a C#-based stager that creates further scheduled tasks, rotates its C2 configuration, downloads follow-on payloads and now unpacks them with WinRAR — fetching WinRAR from Dropbox if the host does not have it.

Hunt priority

Every source below was fetched on 2026-07-25 and its page text saved verbatim to UAC0099-LunchPoke-Notepad-Hunt-sources/. The provenance gate traces each atomic indicator in this pack back to that saved text.

Intel gaps carried into the hunt

• No hashes. Not one source publishes a SHA256, SHA1 or MD5 for LUNCHPOKE, BURNYBEAR or MATCHBOIL.V2.
• No C2. MATCHBOIL.V2's command-and-control infrastructure is described functionally but never named.
• No final payload. BleepingComputer notes explicitly that CERT-UA does not disclose what MATCHBOIL.V2 ultimately delivers, the campaign's objective, or the victim set.
• Rotating literals. CERT-UA states the working-directory name changes; the reporting implies the task name and staging directory do too. Treat all three as samples of a pattern.
• Archive lure names are localised. Ukrainian-language lure filenames were reported. They are useful context but are poor detection anchors outside a Ukrainian-language estate.

Hunt hypotheses

Checks that need no EDR — run these on any Windows host you cannot reach with Falcon, and use them to corroborate an EDR hit before declaring an incident.

7.1 — Scheduled tasks with a minute-level repetition interval

# PowerShell. Any task repeating faster than 5 minutes is unusual outside monitoring agents.
Get-ScheduledTask | ForEach-Object {
    $t = $_
    $t.Triggers | Where-Object { $_.Repetition.Interval -match '^PT[1-5]M$' } |
        ForEach-Object {
            [pscustomobject]@{
                TaskPath = $t.TaskPath
                TaskName = $t.TaskName
                Interval = $_.Repetition.Interval
                Action   = ($t.Actions.Execute -join '; ')
                Args     = ($t.Actions.Arguments -join '; ')
            }
        }
} | Format-Table -AutoSize

7.2 — Any scheduled-task action pointing into the public profile

# The single strongest native check for this campaign. Expect zero rows on a clean host.
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -like "$env:PUBLIC*"
} | Select-Object TaskPath, TaskName, @{n='Exec';e={$_.Actions.Execute}},
                  @{n='Args';e={$_.Actions.Arguments}} | Format-List

7.3 — Executables and DLLs staged under the public profile

# Staging directories observed: %PUBLIC%\Libs_<random>\Notepad\ and %PUBLIC%\Libraries\<random>\
Get-ChildItem -Path $env:PUBLIC -Recurse -Include *.exe,*.dll,*.rar,*.zip -ErrorAction SilentlyContinue |
    Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Sort-Object CreationTimeUtc -Descending | Format-Table -AutoSize

7.4 — Copies of schtasks.exe living outside System32

# Compares file version metadata rather than name, so a rename cannot hide it.
Get-ChildItem -Path $env:PUBLIC, $env:APPDATA, $env:ProgramData -Recurse -Include *.exe -ErrorAction SilentlyContinue |
    Where-Object { $_.VersionInfo.OriginalFilename -eq 'schtasks.exe' } |
    Select-Object FullName, @{n='OriginalName';e={$_.VersionInfo.OriginalFilename}}, CreationTimeUtc

7.5 — Security event log: task registration

# Event ID 4698 = a scheduled task was created. Requires "Audit Other Object Access Events" (Success).
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4698 } -MaxEvents 400 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Public|Libraries|Wallpapers|Libs_' } |
    Select-Object TimeCreated, Id, Message | Format-List

7.6 — Notepad++ installations outside Program Files

# A managed estate should return only the packaged install path, if any.
Get-ChildItem -Path C:\Users, $env:ProgramData -Recurse -Filter 'notepad++.exe' -ErrorAction SilentlyContinue |
    Select-Object FullName, CreationTimeUtc,
                  @{n='PluginDlls';e={ (Get-ChildItem (Join-Path $_.DirectoryName 'plugins') -Recurse -Filter *.dll -ErrorAction SilentlyContinue).FullName -join '; ' }} |
    Format-List

// HUNT: Notepad++ running from %PUBLIC%, ProgramData, AppData or Windows\Temp
// MITRE: T1574.001, T1036 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 process telemetry
// FALSE POSITIVES: portable Notepad++ builds run from a share, a USB stick or a developer sandbox
// TUNING: exclude your software-packaging and build hosts by ComputerName, and any
//         approved portable-app share path, before promoting this to a Scheduled Search
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^notepad\+\+\.exe$/i
| ImageFileName=/\\Users\\Public\\|\\ProgramData\\|\\AppData\\|\\Windows\\Temp\\/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId, ProcessStartTime])

// HUNT: NppExport.dll (or any plugin DLL) dropped under a public/temp path
// MITRE: T1574.001, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten file-write telemetry
// FALSE POSITIVES: plugin developers; portable Notepad++ unpacked to a user directory
// NOTE: NppExport.dll is a GENUINE Notepad++ plugin name -- the write LOCATION is the signal,
//       never the filename on its own. Do not turn this into a filename block.
// TUNING: exclude known developer workstations, and any approved portable-app staging share,
//         by ComputerName before alerting
#event_simpleName=/^PeFileWritten$/
| TargetFileName=/\\plugins\\/i
| TargetFileName=/\.dll$/i
| TargetFileName=/\\Users\\Public\\|\\ProgramData\\|\\AppData\\|\\Windows\\Temp\\/i
| table([ComputerName, UserName, TargetFileName, FileName, ImageFileName, ParentBaseFileName, TargetProcessId])

// HUNT: task registration whose action executes from %PUBLIC% / ProgramData / AppData
// MITRE: T1053.005 | CONF: high  FP: low-med  COST: low
// REQUIRES: ScheduledTaskRegistered telemetry (Windows Event 4698 equivalent)
// FALSE POSITIVES: a small number of RMM, patching and telemetry agents stage under ProgramData
// TUNING: exclude your RMM and patch-agent TaskAuthor values and their ProgramData vendor
//         subdirectories; %PUBLIC% itself should stay in scope with no exclusions at all
#event_simpleName=/^ScheduledTaskRegistered$/
| TaskExecutable=/\\Users\\Public\\|\\ProgramData\\|\\AppData\\/i
| table([ComputerName, UserName, TaskName, TaskExecutable, TaskAuthor, ProcessStartTime])

// HUNT: RemoteLibUpdater.exe, or any process invoked with the BURNYBEAR argument pair
// MITRE: T1204.002, T1053.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: none expected -- neither the filename nor the argument pair is a known product
// TUNING: if a legitimate internal tool shares this name, pin the exclusion to its signed
//         install path via ImageFileName rather than removing the FileName clause
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^RemoteLibUpdater\.exe$/i OR CommandLine=/\bsetup\s+nodisplay\b/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, GrandparentBaseFileName, TargetProcessId])

// HUNT: schtasks.exe copied and renamed (observed as %PUBLIC%\Wallpapers\Background.exe)
// MITRE: T1036.003, T1053.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full command line
// FALSE POSITIVES: installer bundles that ship a renamed copy of a Microsoft utility
// TUNING: exclude signed vendor installers by ImageFileName path; do NOT relax the
//         FileName negation itself, that clause is the entire detection
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\bcreate\b.*\btn\b.*\bsc\b\s+minute/i
| FileName!=/^schtasks\.exe$/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId])

// HUNT: process-lineage proxy for the plugin side-load, which module-load telemetry may not show
// MITRE: T1574.001, T1059 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with ParentBaseFileName populated
// FALSE POSITIVES: the Notepad++ Run menu and the NppExec plugin legitimately spawn shells;
//                  developers do this routinely
// TUNING: exclude your developer workstation group by ComputerName, then triage what remains
//         by ImageFileName -- a Notepad++ under Program Files spawning cmd.exe is far less
//         interesting than one under %PUBLIC% spawning an archiver
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^notepad\+\+\.exe$/i
| FileName=/^(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|schtasks\.exe|winrar\.exe|rar\.exe|unrar\.exe|Background\.exe)$/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId, ParentProcessId])

// HUNT: wscript/cscript invoked on a file whose name shows a document extension,
//       then padding whitespace, then the real .vbs extension
// MITRE: T1036.007, T1204.002, T1059.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full command line
// FALSE POSITIVES: essentially none -- this filename shape exists only to deceive
// TUNING: if a legacy in-house script genuinely carries a doubled extension, exclude that
//         one exact filename rather than loosening the whitespace-padding pattern
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(wscript\.exe|cscript\.exe)$/i
| CommandLine=/\.(pdf|doc|docx|xls|xlsx|jpg|png|txt)\s{2,}[^\\]*\.vbs/i
| table([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, TargetProcessId, ProcessStartTime])

// HUNT: WinRAR/RAR run from a user-writable directory with a password switch
// MITRE: T1560.001, T1140 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with full command line
// FALSE POSITIVES: backup scripts, portable archivers, and legitimate password-protected
//                  transfers between users
// TUNING: exclude your backup and file-transfer service accounts by UserName, and any
//         approved portable-archiver path by ImageFileName; keep %PUBLIC% unexcluded
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(winrar\.exe|rar\.exe|unrar\.exe|7z\.exe|7zg\.exe)$/i
| ImageFileName=/\\Users\\Public\\|\\ProgramData\\|\\AppData\\|\\Windows\\Temp\\/i
| CommandLine=/\s-p/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId])

// HUNT: the CERT-UA-named artefacts, plus execution from the LUNCHPOKE working directory
// MITRE: T1074.001, T1036, T1053.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 and PeFileWritten
// FALSE POSITIVES: low -- but %PUBLIC%\Libraries is occasionally abused by sloppy LOB installers
// NOTE: the directory literal fFthY3-Ytrevc3w-ab3 and the task literal W1n3r-U09oTy-Ap5 are
//       documented by CERT-UA as ROTATING per victim. They confirm a hit; they do not find one.
//       The %PUBLIC%\Libraries and Libs_ path clauses are what actually carries this query.
// TUNING: exclude any approved LOB installer that stages under %PUBLIC%\Libraries by
//         ParentBaseFileName before scheduling
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|ZipFileWritten)$/
| FileName=/^(RemoteLibUpdater\.exe|InitTest\.dll|Background\.exe|updater\.rar|Evernote\.zip)$/i OR TargetFileName=/\\(RemoteLibUpdater\.exe|InitTest\.dll|Background\.exe|updater\.rar|Evernote\.zip)$/i OR ImageFileName=/\\Users\\Public\\(Libraries|Libs_|Wallpapers)/i
| table([ComputerName, UserName, FileName, TargetFileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId])

// HUNT: MATCHBOIL.V2 retrieving WinRAR from Dropbox when the host has no archiver
// MITRE: T1105, T1102 | CONF: medium  FP: medium  COST: low
// REQUIRES: DnsRequest with ContextBaseFileName populated
// FALSE POSITIVES: the Dropbox sync client, browsers, updaters and CI agents all resolve
//                  cloud-storage domains constantly
// TUNING: exclude your sanctioned sync client and browser images by ContextBaseFileName;
//         what should remain is script hosts, unsigned loaders and anything under %PUBLIC%
#event_simpleName=/^DnsRequest$/
| DomainName=/dropbox|easysend|mediafire|mega\.nz|files\.fm/i
| ContextBaseFileName=/^(RemoteLibUpdater\.exe|notepad\+\+\.exe|wscript\.exe|cscript\.exe|Background\.exe|InitTest\.dll)$/i
| table([ComputerName, UserName, DomainName, ContextBaseFileName, ContextProcessId])

Query quality review

Alert package — IOA-1 / Q1

L1 triage checklist

1. Record the full ImageFileName. Is it under %PUBLIC%? If it is under Program Files, this is likely a portable-app FP — note and close.
2. List the directory. A full Notepad++ 8.8.3 tree plus updater.rar plus winrar.exe alongside it is conclusive.
3. Check for plugins\NppExport\NppExport.dll inside that tree and preserve a copy before any removal.
4. Run Q3 host-scoped. Any task pointing into %PUBLIC%, especially at a three-minute interval, escalates immediately.
5. Run Q4 host-scoped for RemoteLibUpdater.exe or the setup nodisplay arguments.
6. Check %PUBLIC%\Wallpapers\ for an executable whose version metadata says schtasks.exe (native hunt 7.4).
7. Identify the parent. A script host parent confirms the VBS delivery stage; pull the original email and the source URL.
8. Sweep the estate with Q1 and Q9 for the same user, the same sender, and the same staging path shape.

Pivot queries

// Host-scoped: everything this host did around the hit. Replace the placeholder,
// then set the time window to the two hours either side in the console.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ComputerName=/^REPLACE_WITH_HOSTNAME$/i
| ImageFileName=/\\Users\\Public\\/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, ProcessStartTime])

// Estate-wide: which hosts have ANY executable content staged under the public profile
#event_simpleName=/^(PeFileWritten|ZipFileWritten)$/
| TargetFileName=/\\Users\\Public\\/i
| groupBy([ComputerName, UserName], function=count(as=Writes))
| sort(Writes, order=desc, limit=100)

Grouped quick-copy. The CSV is shaped for Falcon IOC Management import; the placeholder rows are intentional and must be filled from your own sample before they will import.

type,value,action,severity,platform,description
filename,RemoteLibUpdater.exe,detect,high,windows,BURNYBEAR loader unpacked from updater.rar
filename,InitTest.dll,detect,high,windows,MATCHBOIL.V2 C# stager loaded by BURNYBEAR
filename,updater.rar,detect,medium,windows,Password-protected payload archive unpacked by LUNCHPOKE
filename,Evernote.zip,detect,medium,windows,Second-stage archive carrying Notepad++ 8.8.3 and the rogue plugin
filename,Background.exe,detect,medium,windows,Renamed copy of schtasks.exe used to register the persistence task
scheduled_task,W1n3r-U09oTy-Ap5,detect,high,windows,Persistence task container observed by CERT-UA - name rotates per victim
directory,fFthY3-Ytrevc3w-ab3,detect,high,windows,LUNCHPOKE working directory under the public Libraries folder - name rotates
sha256,REPLACE_WITH_LUNCHPOKE_NPPEXPORT_SHA256,detect,critical,windows,No hash published in any reviewed source
sha256,REPLACE_WITH_BURNYBEAR_REMOTELIBUPDATER_SHA256,detect,critical,windows,No hash published in any reviewed source
sha256,REPLACE_WITH_MATCHBOIL_V2_INITTEST_SHA256,detect,critical,windows,No hash published in any reviewed source
domain,REPLACE_WITH_MATCHBOIL_V2_C2_DOMAIN,detect,critical,windows,MATCHBOIL.V2 C2 never disclosed by CERT-UA
# CONTEXT ONLY - DO NOT IMPORT AS INDICATORS:
# NppExport.dll is a genuine Notepad++ plugin name. Hunt it by write location only.
# notepad++.exe / winrar.exe / schtasks.exe are legitimate signed binaries.
# easysend[.]co is a legitimate consumer file-transfer service that was abused. Monitor - do not block.

%PUBLIC%\Libs_<random digits>\Notepad\        staging directory for the Notepad++ 8.8.3 bundle
%PUBLIC%\Libraries\<random>\                 LUNCHPOKE working directory (observed: fFthY3-Ytrevc3w-ab3)
%PUBLIC%\Wallpapers\Background.exe            renamed copy of schtasks.exe
<staging>\plugins\NppExport\NppExport.dll     LUNCHPOKE, side-loaded by notepad++.exe
<working>\RemoteLibUpdater.exe                BURNYBEAR
<working>\InitTest.dll                        MATCHBOIL.V2
\W1n3r-U09oTy-Ap5\Updates                     scheduled task, runs every 3 minutes
setup nodisplay                               required BURNYBEAR arguments

B1  notepad++.exe executing from %PUBLIC% / ProgramData / AppData / Windows\Temp
B2  a .dll written into any *\plugins\* directory beneath a user-writable path
B3  scheduled task whose action path is under %PUBLIC%
B4  scheduled task repetition interval of 5 minutes or less
B5  a process that is NOT schtasks.exe issuing schtasks create syntax
B6  notepad++.exe as the parent of cmd / powershell / wscript / cscript / an archiver
B7  wscript/cscript command line: document extension + padding whitespace + .vbs
B8  an archiver executing from a user-writable path with a password switch
B9  any process executing from %PUBLIC%\Libraries or %PUBLIC%\Libs_*
B10 a non-browser, non-sync-client process resolving consumer cloud-storage domains
B11 sudden sustained RAM and CPU exhaustion by an unsigned binary run with no arguments
    (BURNYBEAR's deliberate anti-analysis fallback)

{
  "pack": "UAC-0099 LUNCHPOKE / BURNYBEAR / MATCHBOIL.V2",
  "version": "0.1",
  "generated": "2026-07-25",
  "actor": { "primary": "UAC-0099", "relationship": "initial access for APT44 / Sandworm" },
  "malware": ["LUNCHPOKE", "BURNYBEAR", "MATCHBOIL.V2"],
  "targeting": "Ukrainian organisations",
  "atomic_iocs": {
    "filenames": ["RemoteLibUpdater.exe", "InitTest.dll", "updater.rar",
                  "Evernote.zip", "Background.exe"],
    "scheduled_task": "W1n3r-U09oTy-Ap5",
    "directory": "fFthY3-Ytrevc3w-ab3",
    "hashes": [],
    "c2": []
  },
  "context_only_do_not_block": ["NppExport.dll", "notepad++.exe",
                                "winrar.exe", "schtasks.exe", "easysend[.]co"],
  "attack": ["T1566.002", "T1204.002", "T1059.005", "T1036.003", "T1036.005",
             "T1036.007", "T1574.001", "T1140", "T1053.005", "T1074.001",
             "T1105", "T1102", "T1562"],
  "queries": 10,
  "ioa_candidates": 6,
  "known_gaps": ["module-load telemetry", "email gateway", "resource-exhaustion fallback"]
}

Do not mark this pack deployed until every gate below has an owner and a date. Gates 1 to 4 are build-time; gates 5 to 8 are tenant-time and only you can close them.

Every control below is anchored to the specific step in this chain that it breaks. The chain has no exploit in it, so patching is hygiene rather than remediation — the controls that actually stop it are execution location, script handling and task-creation policy.

13.1 — Disable Windows Script Host (M1042)

# Run elevated. Sets both the 64-bit and 32-bit WSH policy keys.
# Reversible: set Enabled back to 1.
$keys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings',
    'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings'
)
foreach ($k in $keys) {
    if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }
    New-ItemProperty -Path $k -Name 'Enabled' -Value 0 -PropertyType DWord -Force | Out-Null
    Write-Host "WSH disabled at $k"
}

# Verify
Get-ItemProperty -Path $keys[0] -Name Enabled | Select-Object Enabled

13.2 — Enable the three relevant ASR rules in Block mode (M1040)

# Run elevated on a pilot ring. Use AuditMode (value 2) first if you are unsure.
$rules = @{
    'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550' = 'Block executable content from email client and webmail'
    'D3E037E1-3EB8-44C8-A917-57927947596D' = 'Block JS/VBScript from launching downloaded executable content'
    '5BEB7EFE-FD9A-4556-801D-275E5FFC04CC' = 'Block execution of potentially obfuscated scripts'
}
foreach ($id in $rules.Keys) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions Enabled
    Write-Host ("Enabled: {0} -- {1}" -f $id, $rules[$id])
}

# Verify: Ids and Actions are positionally paired; 1 = Block, 2 = Audit
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    "{0} = {1}" -f $p.AttackSurfaceReductionRules_Ids[$i], $p.AttackSurfaceReductionRules_Actions[$i]
}

13.3 — Show file extensions estate-wide (defeats the double-extension lure)

# Deploy per-user via GPO preference or logon script. HideFileExt = 0 shows extensions.
$path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
New-ItemProperty -Path $path -Name 'HideFileExt' -Value 0 -PropertyType DWord -Force | Out-Null
Stop-Process -Name explorer -Force # restarts Explorer to apply

# Note: this shows the extension but does NOT collapse the padding whitespace.
# A name padded with 40 spaces still reads as a PDF in a narrow column. Pair this
# with ASR and WSH controls -- on its own it is not sufficient.

13.4 — AppLocker deny rules for user-writable execution paths (M1038)

<!-- Import in AUDIT mode first: Set-AppLockerPolicy -XmlPolicy .\deny-public.xml
     Review 8003/8006 events for a week before switching EnforcementMode to Enabled. -->
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
    <FilePathRule Id="a1b2c3d4-0001-0000-0000-000000000001"
                  Name="Deny EXE from Public profile"
                  Description="UAC-0099 LUNCHPOKE stages the whole chain under %PUBLIC%"
                  UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions><FilePathCondition Path="%OSDRIVE%\Users\Public\*"/></Conditions>
    </FilePathRule>
  </RuleCollection>
  <RuleCollection Type="Dll" EnforcementMode="AuditOnly">
    <FilePathRule Id="a1b2c3d4-0002-0000-0000-000000000002"
                  Name="Deny DLL load from Public profile"
                  Description="Blocks the NppExport.dll plugin side-load at its source"
                  UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions><FilePathCondition Path="%OSDRIVE%\Users\Public\*"/></Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>

13.5 — Enable task-creation auditing (M1047)

# Produces Security Event ID 4698 on task creation. Feed it to your SIEM.
auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

# Verify
auditpol /get /subcategory:"Other Object Access Events"

13.6 — Post-deployment CQL spot-check

// After the AppLocker and WSH rollout, this should trend to zero.
// A flat, non-zero line means the policy did not apply to that host group.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\Users\\Public\\/i
| groupBy([ComputerName], function=count(as=Executions))
| sort(Executions, order=desc, limit=200)

Phase 1 — Isolate (0 to 15 minutes)

1. Network-contain the host in Falcon. Do not power it off — BURNYBEAR's resource-exhaustion fallback and the three-minute task both leave volatile evidence.
2. Disable the user's account sessions if the mail account is implicated, and force a token revocation.
3. Preserve, in this order, before touching anything: running process list, the full %PUBLIC% tree, and the scheduled-task export (schtasks /query /xml ONE).
4. Open the incident with the sender address, the shortener URL and the file-transfer domain from the original email.

Phase 2 — Scope (15 to 90 minutes)

1. Run Q1 and Q9 estate-wide. These two answer "is this one host or a campaign" faster than anything else in the pack.
2. Run Q3 estate-wide for tasks pointing into %PUBLIC%, then native hunt 7.1 for minute-level intervals on any host EDR cannot reach.
3. Pull the mail gateway for every recipient of the same sender, subject or attachment hash. Image-borne links mean URL-rewrite logs may be the only record of who clicked.
4. Run Q7 estate-wide — other victims may still be at the delivery stage and not yet detonated.
5. Check for lateral movement. UAC-0099 hands access to APT44/Sandworm; treat a confirmed hit as a potential precursor to destructive activity, not as commodity malware.

Phase 3 — Eradicate

1. Delete the scheduled task first, before removing files — otherwise it re-launches the loader every three minutes while you work. schtasks /delete /tn "\W1n3r-U09oTy-Ap5\Updates" /f, substituting the task name you actually observed.
2. Terminate RemoteLibUpdater.exe and any notepad++.exe running from a staging path.
3. Collect, then remove: the %PUBLIC%\Libs_* staging tree, the %PUBLIC%\Libraries\* working directory, and %PUBLIC%\Wallpapers\Background.exe.
4. Sweep for additional tasks — MATCHBOIL.V2 registers its own, so removing only the LUNCHPOKE task is not sufficient.
5. Submit the recovered NppExport.dll, RemoteLibUpdater.exe and InitTest.dll for analysis. Populate the hash placeholders in this pack from those samples — you will be the first source of them your organisation has.

Phase 4 — Recover and improve

1. Reimage rather than clean, if MATCHBOIL.V2 executed at all. Its stated purpose is fetching arbitrary follow-on payloads and none of them are documented.
2. Reset the user's credentials and any credentials cached on the host.
3. Deploy the Immediate hardening tier estate-wide if it is not already in place; the WSH control alone breaks this chain.
4. Promote Q1, Q3, Q5 and Q7 to Scheduled Searches with the alert package from section 9.
5. Re-run gates G5 to G8 and record the closure dates in section 11.

Declared gaps

1. CERT-UA — advisory 6318634, "UAC-0099: LUNCHPOKE, BURNYBEAR, оновлений MATCHBOIL.V2 та використання Notepad++ 8.8.3", 2026-07-21. cert.gov.ua/article/6318634 — snapshot 01-cert-ua-6318634.txt (metadata from CERT-UA's own RSS and articles API; body is behind an Angular SPA).
2. The Hacker News — Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks, 2026-07-24. thehackernews.com — snapshot 02-thehackernews.txt.
3. BleepingComputer — Hackers abuse Notepad++ plugins to stealthily install malware, 2026-07-23. bleepingcomputer.com — snapshot 03-bleepingcomputer.txt.
4. Security Affairs — UAC-0099 Is Now Hiding Malware Inside a Fake Notepad++ Plugin to Target Ukrainian Organizations, 2026-07-24. securityaffairs.com — snapshot 04-securityaffairs.txt.
5. Cybersecurity Help — UAC-0099 espionage cluster uses legitimate Notepad++ software to hide malicious code, 2026-07-23. cybersecurity-help.cz — snapshot 05-cybersecurity-help.txt.
6. Cyber Press — Hackers Weaponize Notepad++ 8.8.3 to Silently Install MATCHBOIL.V2 Malware, 2026-07-24. cyberpress.org — snapshot 06-cyberpress.txt.
7. GBHackers — Hackers Weaponize Notepad++ Plugins to Silently Infect Windows Systems, 2026-07-24. gbhackers.com — snapshot 07-gbhackers.txt.
8. MITRE ATT&CK — T1574.001 Hijack Execution Flow: DLL, T1053.005 Scheduled Task, T1036.003/.005/.007 Masquerading, T1204.002 User Execution, T1105 Ingress Tool Transfer. attack.mitre.org
9. MITRE ATT&CK Mitigations — M1038 Execution Prevention, M1040 Behavior Prevention on Endpoint, M1042 Disable or Remove Feature, M1045 Code Signing, M1047 Audit, M1051 Update Software, M1021 Restrict Web-Based Content.
10. Microsoft — Attack Surface Reduction rules reference (rule GUIDs used in playbook 13.2) and Windows Security Baselines.
11. CIS Microsoft Windows Benchmark — Windows Script Host, file-extension display, and audit-policy settings.