CNCERT: Risk Warning Regarding the "Black Cat" Gang's Use of Search Engines to Spread Counterfeit Notepad++ Download Remote Control Backdoors
Essential information
- Published
- 09/01/2026 10:24
- Modified
- 09/01/2026 10:36
- Tags
- 2026-01-09 backdoor notepad phishing seo
- Related entities
- 17 observables, 1 intrusion sets (apt), 1 techniques (mitre), 24 others
Description
CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these high-ranking phishing pages, users are lured by carefully designed download pages, attempting to download software installation packages bundled with malicious programs. Once installed, the program implants a backdoor Trojan without the user's knowledge, leading to the theft of sensitive data from their host computer by attackers.