Surgical Espionage: The “Chrysalis” Backdoor and the 6-Month Hijack of Notepad++

Cybersecurity researchers persist in their investigation of a sophisticated incursion targeting the ubiquitous text editor Notepad++, which remained undetected for nearly half a year—from June through December 2025. By compromising the hosting provider for notepad-plus-plus.org, adversaries gained the leverage to intercept software update solicitations. Consequently, users were served deleterious binaries in lieu of authentic installers; these executed without provocation due to the absence of rigorous digital signature verification in legacy iterations of the editor.

The Rapid7 collective has asserted, with a “moderate degree of confidence,” that the breach is attributable to the Chinese threat actor Lotus Blossom, also recognized by the aliases Lotus Panda and Billbug. This entity typically orchestrates surgical espionage campaigns against organizations in Southeast Asia and, more recently, Central America, focusing its scrutiny on governmental bodies, telecommunications, aviation, critical infrastructure, and the media sector.

According to specialists, the hackers weaponized the compromised Notepad++ update mechanism to disseminate a previously undocumented backdoor dubbed Chrysalis. Upon ingress, they architected a trojanized update in the form of an NSIS installer—a format frequently favored by Chinese adversarial groups for the delivery of malicious payloads.

The installer harbored an executable titled BluetoothService.exe, which was, in reality, a repurposed legitimate utility known as the Bitdefender Submission Wizard. This was employed to facilitate DLL side-loading, a preferred technique among Chinese cyber-espionage operatives. Additionally, the installer contained a file named BluetoothService, housing encrypted shellcode, alongside a nefarious DLL library.

The shellcode constitutes the Chrysalis backdoor itself. Rapid7 posits that its expansive functional repertoire suggests a highly advanced, persistent instrument rather than a rudimentary, ephemeral utility. The malware leverages legitimate executables to load malicious libraries disguised with innocuous nomenclature, thereby evading detection by superficial file-name-based security tools. Furthermore, it employs specialized API hashing within both the loader and the primary module, multiple strata of obfuscation, and a meticulously structured protocol for communication with command-and-control (C2) servers.

At the time of disclosure, Rapid7 lacked definitive data regarding the precise number of victims who inadvertently retrieved the Chrysalis malware. Nevertheless, researchers have promulgated an exhaustive catalog of file-based and network-centric indicators of compromise (IoCs).

The attribution to Lotus Blossom is predicated primarily on the tactical congruencies observed in prior Symantec research. Specifically, the adversaries utilized the renamed Bitdefender Submission Wizard to load log.dll, tasked with decrypting and executing auxiliary malicious payloads. Moreover, the striking similarities in the execution chain and the identical public key extracted from Cobalt Strike beacons further implicate Lotus Blossom in this coordinated campaign.