What Australian businesses should check this week
Notepad++ confirmed a targeted compromise affecting parts of its update delivery path during 2025, including individuals in Australia. The application itself stayed intact, but the mechanism responsible for distributing updates was abused to reach selected users. This type of exposure is easy to overlook in corporate environments because update traffic is typically trusted.
Any business that has used Notepad++ should be treating this as a supply chain exposure until you prove otherwise.
You may have been compromised if:
If either of these are true, there’s a chance you or your organisation has been targeted.
- Notepad++ is installed on work machines used by IT, security, engineering, or operations teams
- Anyone updated Notepad++ between June 2025 and December 2025 using the in-app updater
You are lower risk if:
- Notepad++ is not installed inside your organisation
- Notepad++ is installed but updates were blocked
- Notepad++ was installed but never updated in that window
The reporting shows that targeting was deliberate and kept to small numbers. The organisations that were targeted were mostly telecoms, finance, technology companies, and service providers because they support large numbers of people and critical systems.
How the attack happened
At some point in 2025, attackers gained access to part of the infrastructure that helps handle update checks. That gave them a way to quietly interfere when certain machines checked for updates, without touching the core Notepad++ software.
For people who were targeted, the update process looked normal. Notepad++ would check for updates in the usual way and continue without any warnings. What changed was what came back during that check. In some cases, the update process was used to deliver extra malicious files alongside normal behaviour.
That’s why targeted users wouldn’t have noticed anything wrong. The editor still opened and worked as expected. The real impact came from what was added in the background, like tools used to collect information about the system or establish ongoing access.
Older versions of the updater also trusted the network response more than they should have. That made it easier for someone sitting in the middle of the connection to swap in something harmful without being challenged. Combined with careful, selective targeting, this allowed the activity to stay quiet for months.
Who the attackers went after
The number of victims identified so far is small and they are spread across a few countries, including Australia.
The types of organisations affected are also the same sectors we’ve seen targeted in other China-linked campaigns, including ones we’ve covered before like Salt Typhoon, where the goal is access and insight rather than disruption.
What to look for on your endpoints
- GUP.exe making outbound network calls to places other than the official Notepad++ and GitHub release infrastructure
- GUP.exe launching unexpected child processes after an update check
- New executables written into user temp folders around update time, especially files named update.exe or AutoUpdater.exe
- Unexpected use of curl.exe around the same time, especially calls to temp.sh
- Unusual new folders under AppData that do not match normal Notepad++ behaviour, including paths referenced in public reporting such as ProShow, Adobe Scripts, or Bluetooth
f you have EDR, the cleanest hunting angle is process lineage. Look for GUP.exe then follow what spawned and what wrote to disk.
Quick self check for Australian leaders
Ask your team these three questions today.
- Do we have Notepad++ installed on corporate machines?
- Did any of those machines update it in mid 2025?
- Can we quickly validate updater behaviour using endpoint telemetry?
