Supply Chain Poison: Lotus Blossom Hits Notepad++ to Deploy “Chrysalis”

Rapid7 analysis describes Lotus Blossom (a Chinese state-linked APT) performing a supply-chain compromise of the Notepad++ infrastructure to deploy a new backdoor named Chrysalis. The attackers used a Warbird-protected loader (ConsoleApplication2.exe), DLL side-loading, custom loaders, and blended commodity tooling (Cobalt Strike, Metasploit) to increase stealth and resilience; Rapid7 attributes the activity to Lotus Blossom with moderate confidence.