136
submitted 7 months ago by BrikoX@lemmy.zip to c/technology@lemmy.zip

Suspected China-state hackers used update infrastructure to deliver backdoored version.

you are viewing a single comment's thread
view the rest of the comments
[-] pulsewidth@lemmy.world 7 points 7 months ago* (last edited 7 months ago)

If you're worried that this may have hit your PC I'd say first of all be aware that this is a state-level backdoor, intended to be persistent and evade detection. You are likely not the target and are very unlikely to find any evidence even if you were targeted, as it is capable of clearing its tracks.

Actions I'd suggest if you're still worried this could have hit your PC:

  1. Grab the list of Indicators of compromise from the bottom of this article. Disconnect the PC from the Internet now that you have the list.
  2. Search for any instances of these files locally and SHA-256 hash them if found, and match to the hashes on the list. If you find any matches, your system is compromised.
  3. Check the DNS cache for any hosts mentioned in the indicators, and if you have network traffic logging you could check there also. Indicators are very likely signs of prior/active attack on your PC.
  4. If nothing found, reconnect to the net and continue..
  5. uninstall Notepad++, or if you want to keep using it, update Notepad++ via a method other than their internal update method. I suggest powershell using winget as its preinstalled in Win10 & 11.
PS > winget list -q Notepad++
(will show you available updates)
PS > winget upgrade -q Notepad++
(Will install the update if available) 

  1. (Optional) disable Notepad++ internal update mechanism, and use winget or another method moving forward. Settings -> Preferences -> MISC: Auto-updater: Disable.
this post was submitted on 02 Feb 2026
136 points (98.6% liked)

Technology

7279 readers
595 users here now

News community around technology, social media platforms, information technology and governmental policy surrounding it.

What doesn't fit here?

The core of the story has to be technology focused.


Post guidelines

Title formatPost title should mirror the news source title. If you don't like the title of article, look for an alternative source instead of editorializing it.
URL formatPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
[Opinion] prefixOpinion (op-ed) articles must use [Opinion] prefix before the title. Opinion articles refer to articles that their publisher doesn't explictly endorse.
Country prefixCountry prefix can be added to the title with a separator (|, :, etc.) if the news is from a local publisher who doesn't clearly mention the country.


Rules

1. English onlyTitle and associated content has to be in English.
2. Use original linkPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
3. Respectful communicationAll communication has to be respectful of differing opinions, viewpoints, and experiences.
4. InclusivityEveryone is welcome here regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
5. Ad hominem attacksAny kind of personal attacks are expressly forbidden. If you can't argue your position without attacking a person's character, you already lost the argument.
6. Off-topic tangentsStay on topic. Keep it relevant.
7. Instance rules may applyIf something is not covered by community rules, but are against lemmy.zip instance rules, they will be enforced.


Companion communities

!globalnews@lemmy.zip
!interestingshare@lemmy.zip


Icon attribution | Banner attribution


If someone is interested in moderating this community, message @brikox@lemmy.zip.

founded 2 years ago
MODERATORS