Kaspersky Global Research and Analysis Team researchers have discovered that attackers behind the Notepad++ supply chain compromise targeted a government organisation in the Philippines, a financial institution in El Salvador, an IT service provider in Vietnam and individuals across three countries using at least three distinct infection chains — two of which remain unknown to the public.
The attackers completely overhauled their malware, command-and-control infrastructure and delivery methods roughly every month between July and October 2025. The single attack chain publicly documented to date represents only the final phase of a much longer and more sophisticated campaign.
The Notepad++ developers disclosed on February 2, 2026, that their update infrastructure had been compromised due to a hosting provider incident. Previous public reporting focused exclusively on malware observed in October 2025, leaving organisations unaware of the entirely different indicators of compromise used from July through September.
Each chain used different malicious IP addresses, domain names, execution methods and payloads. Organisations that scanned only for the October indicators may have missed earlier infections entirely. Kaspersky solutions blocked all identified attacks as they occurred.
“Defenders who checked their systems against the publicly known IoCs and found nothing should not assume they’re in the clear,” said Georgy Kucherin, senior security researcher at Kaspersky GReAT. “The July-September infrastructure was completely different — different IPs, different domains, different file hashes. And given how frequently these attackers rotated their tooling, we cannot rule out the existence of additional, as-yet-undiscovered chains.”
Kaspersky GReAT has published the full list of indicators of compromise, including six malicious updater hashes, 14 C2 URLs and eight malicious file hashes not previously reported. The complete IoC list and technical analysis are available at Securelist.
