Black Cat Hacker Group Uses Fake Notepad++ Websites to Distribute Malware and Steal Data

A Black Cat cybercriminal campaign used SEO-poisoned fake Notepad++ download sites and multi-stage redirects to deploy a custom data-stealing backdoor. The malware achieves persistence via registry startup entries and DLL side-loading, decrypts and reflectively loads payloads (e.g., M9OLUM4P.1CCE), and communicates with C2 at sbido.com; researchers reported ~277,800 compromised servers in China with daily botnet peaks over 62,000.