CYBERSECURITY
OPEN SOURCE
SUPPLY CHAIN
Notepad++: an update infrastructure compromised for 6 months without the community noticing
Notepad++ is open source, auditable, transparent. Its update infrastructure, however, was compromised for 6 months without the community noticing.
Between June and December 2025, the host of Notepad++’s update servers was infiltrated by Lotus Blossom, a Chinese APT group specialising in government espionage.
Their target was not the mass of users, but a few dozen carefully chosen machines: public administrations, the financial sector, IT suppliers in South-East Asia, in Central America, as far as Australia.
The mechanism, for its part, made it possible to target anyone: developers, sysadmins, anyone with privileged access.
But how did they manage it? Through an update.
The malware deployed, named Chrysalis, is a sophisticated backdoor (interactive shell, file exfiltration, remote access, persistence through a Windows service, self-deletion), designed to last and to avoid detection. It hid behind a legitimate Bitdefender binary renamed BluetoothService.exe, and its command server imitated the DeepSeek API to fly under the radar.
What makes this attack particularly interesting is what was targeted: trust. The trust we place in a tool we have used for years.
This attack is a reminder: the security of open source software is not limited to its code, it includes its distribution infrastructure, its update mechanisms, its hosts. Checking hashes manually is basic hygiene.
Immediate actions if you use Notepad++: update to version 8.9.2 at least (ideally 8.9.4, the latest version) from notepad-plus-plus.org, which introduces the “double-lock” cryptographic verification of updates; clean reinstall if exposed between June and December 2025; hunt for IoCs (BluetoothService.exe outside its usual path, suspicious child processes of gup.exe).
The Notepad++ compromise raises a question few software publishers ask themselves: where do you host your updates, and who guarantees their integrity?
France-IX can host mirror servers for distributing software updates. It is not a silver bullet, but in a more resilient distribution chain, every link of trust counts.
This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post