Lotus Blossom abuses Notepad++ update delivering Chrysalis backdoor

EXECUTIVE SUMMARY

Researchers discovered a targeted intrusion campaign linked to Lotus Blossom involving abuse of the software distribution process of Notepad++. The activity began when responders noticed that normal application execution was followed by the launch of a suspicious installer downloaded from external infrastructure. This installer was used to deploy a custom backdoor named Chrysalis, marking the start of the compromise. Evidence showed that the attackers relied on trusted application behavior to hide their activity and reduce early detection. During the investigation, analysts also found several custom loaders used to prepare and launch additional payload stages. One loader used Microsoft Warbird protection features to hide how shellcode was executed, showing attempts to bypass security monitoring. While reporting suggested that the compromise may have involved plugin or update abuse, no single method could be fully confirmed. However, the confirmed execution chain showed legitimate processes launching updater activity that then executed the malicious installer.[emaillocker id="1283"]

Analysis showed that the installer unpacked multiple files into a hidden directory and launched a renamed legitimate program to perform DLL sideloading. A malicious library was loaded instead of the expected one, allowing encrypted shellcode to be decrypted and executed in memory. The decryption routine used a custom algorithm to unpack the payload, which then launched the Chrysalis backdoor. The backdoor used multiple layers of obfuscation, including repeated XOR decoding, reflective loading, and dynamic API resolution to hide its behavior. Important strings and function names were reconstructed only during execution, making static inspection harder. Configuration data stored inside the staged files revealed command server details and operational settings after decryption. The malware then established persistence through service creation or registry changes depending on execution arguments. After installation, it collected system information, created a unique identifier for the infected device, encrypted collected data, and communicated with remote infrastructure over secure web traffic. The command handler supported several actions such as running commands, creating processes, reading, and writing files, transferring data, and removing traces.

The intrusion shows how attackers continue to improve their methods while still relying on familiar techniques such as DLL sideloading and persistence through services. The Chrysalis backdoor appears to be designed for long-term use, with structured command handling and flexible control features that allow different post-compromise actions. At the same time, the attackers combined custom malware with commonly available tools to simplify deployment while keeping strong control over infected systems. The use of layered loaders, hidden execution, and runtime decoding indicates an effort to reduce detection and slow analysis. The Warbird-based loader demonstrates experimentation with less common execution paths that can help malware run inside trusted memory regions. Investigators also observed multiple loader variants and shared infrastructure, suggesting ongoing development and reuse of supporting tools. Similarities in execution flow, payload behavior, and tooling helped link the activity to previously known operations associated with the group. Overall, the campaign highlights a balanced approach where attackers mix trusted application abuse, custom backdoors, and staged payload delivery to maintain access and execute commands while keeping activity hidden from standard monitoring controls.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://www.csoonline.com/article/4134135/notepad-author-says-fixes-make-update-mechanism-effectively-unexploitable.html
• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/