23
Notepad++ hijacked by state-sponsored hackers (notepad-plus-plus.org)
submitted 6 months ago by [M] to c/opensource@programming.dev
5 comments fedilink hide all child comments

all 6 comments

sorted by: hot top controversial new old
[–] 5 points 6 months ago

He added a link to a deep dive for the backdoor used in the attack.

https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 6 months ago

    It used to be that being a ML (Malicious Linguist) in someones garage was the rage, now we got "Hackers with Chinese characteristics" smh

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 6 months ago (2 children)

    I'm so confused.

    1. It doesn't say anything about "state-sponsored attackers" outside of the headline? What state? Why?
    2. Why is a Notepad app connecting to any servers or have credentials at all?
  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    It wasn't specifically notepad++ code, but a custom-written updater. That's why it was connecting to the internet.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •