CampaignPublished 9 Jan 2026Updated 8 Feb 2026

CNCERT: Risk Warning Regarding the "Black Cat" Gang's Use of Search Engines to Spread Counterfeit Notepad++ Download Remote Control Backdoors

Source AlienVault OTX General

Description

CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these high-ranking phishing pages, users are lured by carefully designed download pages, attempting to download software installation packages bundled with malicious programs. Once installed, the program implants a backdoor Trojan without the user's knowledge, leading to the theft of sensitive data from their host computer by attackers.

Impact

For European organizations, this threat poses a risk of sensitive data theft, potential intellectual property loss, and unauthorized remote access to infected systems. Organizations relying on Notepad++ or similar open-source software for development or administrative tasks may inadvertently introduce backdoors into their environments. The stealthy nature of the backdoor Trojan can facilitate prolonged attacker presence, enabling further lateral movement and data exfiltration. This can lead to operational disruption, reputational damage, and regulatory compliance issues, especially under GDPR requirements for data protection. The campaign’s use of SEO to distribute malware increases the attack surface, as even cautious users may be deceived by high-ranking search results. The threat is particularly concerning for sectors with high software usage and development activity, such as finance, technology, and government agencies. Additionally, the campaign could indirectly impact supply chain security if infected machines are used to develop or distribute software internally. The medium severity reflects the need for vigilance but also the requirement for user interaction to succeed.

Defensive guidance

European organizations should implement a multi-layered defense strategy against this threat. First, enforce strict policies to download software only from verified official sources or trusted repositories, avoiding third-party sites promoted via search engines. Educate users about the risks of downloading software from search results and the importance of verifying digital signatures or checksums of installation packages. Deploy endpoint detection and response (EDR) tools capable of identifying backdoor behaviors and unusual network communications indicative of remote control Trojans. Use web filtering solutions to block access to known phishing domains and monitor DNS queries for suspicious patterns. Regularly audit installed software for unauthorized or counterfeit applications. Implement network segmentation to limit the impact of compromised endpoints and enforce least privilege access controls. Maintain up-to-date threat intelligence feeds to detect emerging phishing domains related to this campaign. Finally, conduct phishing simulation exercises to raise awareness and improve user detection capabilities.

Indicators of compromise

Domains 24

alonesad.com
cdn-ccdown.com
clash.ac.cn
clash.net.cn
clashforwindows.org.cn
cn-notepadplusplus.com
duooi.com
golomee.com
hiluxo.com
jiaweo.com

IP addresses 7

154.213.190.46CC=HK ASN=AS55933 cloudie limited
137.220.252.82CC=JP ASN=AS64050 bgpnet global asn
206.119.64.108CC=US ASN=AS8796 kurun cloud inc
223.26.63.103CC=HK ASN=AS64050 bgpnet global asn
27.50.54.144CC=HK ASN=AS64050 bgpnet global asn
27.50.63.118CC=HK ASN=AS64050 bgpnet global asn
38.55.16.61CC=US ASN=AS8796 kurun cloud inc

Hashes 12

2421472c0f4b34e60dd38e20a4771cb5MD5 of b94c54290015ed751c84d0a9bfa6e63481c72c0d7528b4b65a2816f72ea5c994
eac4b3801e292f75bf92c4002ba1919f71e4636bSHA1 of b94c54290015ed751c84d0a9bfa6e63481c72c0d7528b4b65a2816f72ea5c994
087ce894e139f281bd9ebd4b78d4451e458357cef38807e5b4b98ef3ba2fd35c
267f5bcedb5b1ebaa855b9b041351892868d0b4a9153517178ef02a55a6f17bd
3fe9868b56cfbb4de67f65afece0ac95a16267e44d2f555c25263fd641ed7374
46c9e9e2003f92ea1aa06984b02d4827deae71631c5ecf2bed5e4f7f8d5d16c8
8c6e135ea743c82d6f36facd293f5ddc01973ab0c5c52f42ed70e2885e838c4c
9868a6e020f35b8e55f6e2366feea72e617648ab7ebad1972d093642f3058f70
aa8e535d8576f0471a98865eb44e5e5ae3c3a279f15807e9a8317adb80bf8c9d
b0fcdb33e486ddbc0553f201cf6b9255ec22a12cb85dc9d12ebceb9c7308e51d

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Jan 2026, 10:28 UTC

MITRE ATT&CK techniques2 from threat tags

Technical details

Indicators of compromise

Domains 24

IP addresses 7

Hashes 12

Community reviews

Related threats