Notepad++ Discloses Full Details of 2025 Supply Chain Attack by Chinese APT Lotus Blossom

Notepad++ has published a detailed retrospective of a supply chain attack that compromised the text editor\'s hosting infrastructure from June through December 2025. The attack, attributed to Chinese state-sponsored threat group Lotus Blossom (also tracked as Zirconium or Violet Typhoon by other researchers), involved hijacking the WinGUp update mechanism to deliver malicious executables to a carefully selected subset of users.

How the Attack Worked

The compromise did not exploit a vulnerability in Notepad++\'s code itself. Instead, attackers gained infrastructure-level access to the project\'s hosting environment and exploited insufficient update verification controls in the WinGUp updater. The targeting was highly selective: traffic from specific users was silently redirected to malicious update servers while the vast majority of legitimate update requests were served normally, allowing the attack to evade detection for months.

Over a four-month period from July to October 2025, attackers continuously rotated command-and-control server addresses, the downloaders used for implant delivery, and the final payloads themselves, further complicating detection and attribution. Researchers from multiple security firms identified a custom backdoor dubbed Chrysalis alongside Cobalt Strike and Metasploit frameworks as the primary tools deployed to compromised targets.

Remediation and Current Status

Following discovery, the Notepad++ project migrated to a new hosting provider and made substantive changes to the WinGUp updater. Version 8.8.9 of Notepad++ introduced verification of both the certificate and the digital signature of downloaded installers before execution, closing the pathway that attackers exploited. Users who have not yet updated to 8.8.9 or later should do so immediately.

The incident is a reminder that even widely trusted open source tools with large user bases can be compromised at the infrastructure layer rather than at the code level, and that update mechanisms deserve the same rigorous security scrutiny as the software they deliver.