“This backdoor enables this threat actor to install a keylogger on the machine and communicate with a C2 server to send the output of this software.” “The APT group StrongPity is known to leverage a legitimate Notepad++ installer accompanied with malicious executables, allowing it to persist after a reboot on a machine,” the Cybereason advisory reads.

However, advanced persistent threat (APT) groups have leveraged Notepad++ plugins for nefarious purposes in the past. NET package for Visual Studio that provides a basic template for building plugins. “Using an open–source project, Notepad++ Plugin Pack, a security researcher that goes by the name RastaMouse was able to demonstrate how to build a malicious plugin that can be used as a persistence mechanism,” the company wrote in an advisory on Wednesday. Later, we press Delete or Shift + Delete to delete them permanently.Threat actors may abuse Notepad++ plugins to circumvent security mechanisms and achieve persistence on their victim machine, new research from security company Cybereason suggests. In the event that there are several folders, we can use Shift and Ctrl to select several at the same time. We select the folders of the plugins that you want to remove. To do this, we open the File Explorer and go to the path where we have saved them. In the event that we have installed them manually, we must remove them in the same way. Once this is done, click on the Delete button and the removed add-ons will be placed back in the Available tab, so that we can reinstall them at any other time. Here, we check the boxes corresponding to the plugins we want to remove, being possible to remove more than one at a time, just by checking them. In the new window we click on the Installed tab. We open Notepad++ and click on the Plugins tab and then click on Manage Plugins. We can carry out this process without fear, because, even if we uninstall it, it does not prevent us from being able to install it again later, if we need it again, following the previous steps. From the Notepad++ plugin manager itself we can uninstall those plugins that we have installed from it, since those that we have installed manually will also need to be removed in the same way.

Making notepad++ plugins