renat0z3r0/notepadpp-supply-chain-iocs
PoCIoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale queries, YARA/Sigma rules, and MITRE ATT&CK mapping.
01
exploited CVEs (1)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-15556US | high7.5OT critical | KEV | ||
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cry… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan